URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints initiate downloads from known malicious URLs identified by URLhaus, indicating potential initial access or execution of malware payloads. The SOC team should proactively investigate these events in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the downloaded malware establishes persistence on the network.

IOC Summary

Threat: malware_download Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["113.238.64.130", "123.14.89.9", "182.116.75.200", "115.63.50.54"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["113.238.64.130", "123.14.89.9", "182.116.75.200", "115.63.50.54"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Software Updates

  • Scenario: Automated agents for tools like Microsoft Intune, Jamf Pro, or Ivanti Endpoint Manager frequently download large update packages (e.g., driver updates, OS patches) from vendor repositories. These repositories often host thousands of executables that URLhaus may flag as “malware_download” due to the sheer volume of new binaries being distributed globally before a full reputation score is established.
  • Suggested Filter: Exclude traffic originating from known internal management server IP ranges (e.g., 10.x.x.x or specific Cloudflare IPs used by the vendor) and filter URLs containing paths like /updates/, /packages/, or specific vendor domains (e.g., *.microsoft.com, *.jamfsoftware.com).

• Scheduled Backup and Archiving Jobs

  • Scenario: Enterprise backup solutions such as Veeam, Commvault, or Rubrik perform scheduled jobs that download metadata, configuration snapshots, or software components from cloud storage buckets (e.g., Azure Blob Storage, AWS S3). These downloads often involve large .zip, .tar, or proprietary archive files which can trigger the malware_download tag if the specific file hash is new to the URLhaus database.
  • Suggested Filter: Create an exclusion rule for traffic generated by service accounts associated with backup software (e.g., svc-veeam-backup) and filter URLs pointing to object storage endpoints that utilize standard secure paths like /api/v1/download or specific bucket names known to the organization.

• Third-Party Application Patching via WSUS/SCCM

  • Scenario: In environments using **System Center Configuration