URLhaus: rat Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving remote access trojan (RAT) malware by flagging network traffic directed toward known malicious URLs curated by URLhaus. Proactive hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement or data exfiltration before the RAT establishes persistence on the network.

IOC Summary

Threat: rat Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["107.173.143.56"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["107.173.143.56"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: rat Malicious URLs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Ransomware Backup Scans by Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam Backup & Replication, Commvault) frequently initiate connectivity checks against their cloud management portals. These URLs often host the rat (RAT) agent components for remote management and can be flagged if the URL contains specific paths or query strings resembling known RAT distribution points.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host being part of the “Backup-Infrastructure” AD group, combined with a destination port filter (e.g., 443) and a specific user agent string containing Veeam or Commvault.

• Scenario: Microsoft Defender for Endpoint (MDE) Cloud Connectivity Checks

  • Context: The MDE sensor performs periodic “heartbeat” and policy synchronization calls to the Microsoft 365 cloud. These endpoints often utilize URLs tagged with RAT signatures in threat intelligence feeds due to their role in remote management and telemetry collection, which mimics RAT behavior patterns.
  • Filter/Exclusion: Exclude traffic where the Destination Domain matches known Microsoft service domains (e.g., *.microsoft.com, *.azureresources.azure.cn) AND the Process Name is MsMpEng.exe or SenseService.exe.

• Scenario: Remote Desktop Gateway (RDGW) and Citrix Workspace Connections

  • Context: When users access internal resources via RDGW or Citrix, the client software establishes persistent connections to remote management URLs. These URLs often host the “Remote Access Tool” components required for session brokering, which URLhaus may classify as `