URLhaus: opendir Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious URLs flagged by URLhaus with an “opendir” signature, which often indicates attempts to exploit directory traversal vulnerabilities or execute unauthorized file operations on compromised endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected systems and prevent potential lateral movement or data exfiltration stemming from web-based attacks before they escalate into broader incidents.

IOC Summary

Threat: opendir Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: opendir
let malicious_domains = dynamic(["94.154.43.238", "193.233.82.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.238", "193.233.82.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the URLhaus: opendir Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Tenable Nessus or Qualys

  • Context: Security teams often schedule nightly vulnerability scans where tools like Tenable Nessus or Qualys Cloud Agent probe internal web servers. These scanners frequently attempt to open directory listings on legacy IIS or Apache servers (e.g., http://internal-web-server/), triggering the “opendir” signature as they enumerate file structures to identify exposed directories.
  • Filter/Exclusion: Create an exclusion rule based on the source IP range of the scanning infrastructure (e.g., 10.20.50.x) or filter out traffic where the User-Agent string contains specific scanner identifiers like Nessus or Qualys.

• Scenario: Scheduled Backup Jobs Using Veeam or Commvault

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often perform pre-backup validation checks. During these tasks, the backup engine connects to file shares or web repositories to verify directory accessibility and list contents before initiating data transfer, which mimics the behavior of an opendir attack vector.
  • Filter/Exclusion: Exclude alerts generated by known backup service accounts (e.g., svc_backup_admin) or filter URLs that point to internal storage gateways (e.g., domains ending in .corp.local or specific IP subnets like 192.168.100.x).

• Scenario: CI/CD Pipeline Artifact Verification by Jenkins or GitLab

  • Context: In DevOps environments, continuous integration tools like Jenkins or GitLab Runners execute build pipelines that include steps