URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where endpoints download files from known malicious URLs flagged by URLhaus as part of a malware distribution campaign. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised hosts and prevent lateral movement before the downloaded payloads execute on critical systems.

IOC Summary

Threat: malware_download Total URLs: 8 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["24.54.95.49", "163.142.92.245", "123.10.131.161"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["24.54.95.49", "163.142.92.245", "123.10.131.161"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download rule in an enterprise environment, along with targeted filtering strategies:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query external repositories to download security updates and hotfixes. These downloads often originate from dynamic URL structures that may be flagged as “malware_download” due to high traffic volume or new hash signatures before the URL is fully whitelisted in the threat intelligence feed.
  • Filter/Exclusion: Create a rule exclusion based on the source device group (e.g., DeviceGroup = 'PatchServers') and the specific process name (ProcessName = 'ccmsetup.exe' or IvantiAgentService). Additionally, exclude URLs containing known vendor domains like .microsoft.com, .ivanti.com, or .solarwinds.com.

• Scenario: Endpoint Antivirus Definition Updates

  • Context: Managed antivirus solutions such as CrowdStrike Falcon, SentinelOne, or Carbon Black perform scheduled jobs to download the latest virus definition databases and threat intelligence feeds. These downloads often trigger high-confidence alerts because the URLhaus engine detects the rapid ingestion of large, binary-rich files which mimic malware distribution patterns.
  • Filter/Exclusion: Implement a filter excluding traffic where the ProcessName matches the specific AV agent (e.g., csfalcon.exe, S1Agent.exe) and the destination domain belongs to the vendor’s update infrastructure (e.g., *.crowdstrike.com, *.sentinelone.net).

• Scenario: Software Deployment via Microsoft Intune

  • Context: When IT administrators deploy new line-of-business applications or updates via Microsoft Intune, devices