URLhaus: opendir Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving malicious URLs associated with the “opendir” threat, which often indicates compromised web servers or phishing campaigns leveraging directory traversal vulnerabilities. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before attackers can exploit exposed file structures within the organization’s network.

IOC Summary

Threat: opendir Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: opendir
let malicious_domains = dynamic(["95.155.151.113"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["95.155.151.113"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: opendir Malicious URLs detection rule, along with recommended filters or exclusions:

• Scenario: Automated Vulnerability Scanning by Enterprise Tools

  • Context: Security tools like Tenable Nessus, Qualys, or Rapid7 InsightVM frequently probe internal and external endpoints. During scans, these agents often attempt to enumerate directory structures (simulating an opendir system call) on web servers to map assets. If the scanner’s IP range accesses a URL known to trigger opendir signatures in the 9-tagged set, it generates alerts.
  • Filter/Exclusion: Create an exclusion rule based on the Source IP ranges of your vulnerability management appliances (e.g., 10.20.50.0/24) or exclude traffic where the User-Agent string contains “Tenable,” “Qualys,” or “Rapid7.”

• Scenario: Scheduled Backup and Archive Operations

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Commvault perform nightly jobs that traverse file systems to archive data. These agents often utilize opendir logic when accessing cloud storage gateways (e.g., AWS S3, Azure Blob) via HTTPS URLs to verify directory integrity before ingestion.
  • Filter/Exclusion: Exclude alerts occurring during defined maintenance windows (e.g., 02:00–06:00 local time) for specific Service Accounts used by backup agents (e.g., svc_backup_01, backup_agent). Additionally, filter out URLs containing standard backup API paths like /api/v1/archive or /snapshot/list.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: