URLhaus: redis Malicious URLs

Hunt Hypothesis

This rule identifies potential Redis malware activity by detecting known malicious URLs associated with command-and-control channels and data exfiltration, often leveraging compromised Redis servers for persistence. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify stealthy C2 communications and exfiltration paths that may bypass traditional network perimeter defenses.

IOC Summary

Threat: redis Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: redis
let malicious_domains = dynamic(["217.217.233.97"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.217.233.97"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a Redis instance as a temporary message broker or cache for a new microservice during a staging deployment, where the application code dynamically constructs URLs pointing to the internal Redis endpoint for health checks or data polling.
  • Filter/Exclusion: Exclude network connections where the source IP is within the 10.0.0.0/8 or 172.16.0.0/12 private ranges AND the destination port is 6379 (standard Redis port) or 80/443 if Redis is behind a reverse proxy. Additionally, whitelist known internal DNS names like redis-staging-01.internal.corp.com.
• Scenario: A scheduled backup job (e.g., using redis-rdb or a custom Python script) connects to a Redis cluster to dump keyspace data to an S3 bucket, generating HTTP/HTTPS traffic to a URL that matches the pattern of the malicious URLhaus entry due to a shared CDN or similar path structure (e.g., /v1/export/redis).
  • Filter/Exclusion: Exclude traffic initiated by service accounts with specific AD group memberships (e.g., G_Backup_Services) or from known backup appliance IPs (e.g., 192.168.10.50-192.168.10.55). Filter out URLs containing path segments like /backup/, /dump/, or /rdb/.
• Scenario: A CI/CD pipeline (e.g., Jenkins or GitLab CI) runs a smoke test that spins up a temporary Redis container and accesses it via a dynamically generated URL for configuration retrieval, which may coincidentally match the URL pattern if the test harness uses a public test CDN or a shared internal URL prefix.
  • **Filter/