URLhaus: redis Malicious URLs

Hunt Hypothesis

This hunt targets adversary activity involving the use of Redis-related malicious URLs, which are frequently leveraged for command-and-control channels or data exfiltration in cloud-native environments. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised workloads or lateral movement attempts before they escalate into broader infrastructure breaches.

IOC Summary

Threat: redis Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: redis
let malicious_domains = dynamic(["a.hbweb.icu", "217.60.78.186", "kiss.a-dog.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["a.hbweb.icu", "217.60.78.186", "kiss.a-dog.top"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to run integration tests against a staging Redis instance hosted on a public cloud provider. The test script explicitly connects to the endpoint redis://192.168.1.5:6379 or a public IP, which matches one of the URLhaus entries due to a shared subnet or known benign IP reuse.

  • Filter/Exclusion: Exclude network connections where the source process is a known CI/CD agent (e.g., agent.exe, jenkins-agent.jar, docker-cli) and the destination port is 6379. Alternatively, whitelist specific source IP ranges used by the CI/CD infrastructure.

• Scenario: An application monitoring tool (e.g., Datadog Agent, New Relic, or AppDynamics) performs periodic health checks or metric collection by connecting to the Redis server. The agent’s configuration file contains the Redis URL, and the connection is initiated by the monitoring service process rather than the application itself.

  • Filter/Exclusion: Exclude connections where the source process name matches known monitoring agents (e.g., datadog-agent.exe, newrelic-agent.exe, appdynamics-agent.exe) and the destination port is 6379.

• Scenario: A database administrator runs a scheduled backup job using a tool like redis-dump or ripgrep (if used for log analysis against Redis logs) that connects to the Redis instance. The job runs via a scheduled task (Windows Task Scheduler or Linux Cron) and may use a hardcoded URL that coincidentally matches a URLhaus entry.

  • Filter/Exclusion: Exclude connections where the source process is associated with backup or maintenance tools (e.g., redis-dump.exe, pg_dump if used