URLhaus: script Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging phishing emails with malicious URLs to execute scripts that facilitate data exfiltration and establish command-and-control channels. Proactive hunting in Azure Sentinel is essential to identify early-stage script execution anomalies and unexpected network connections before attackers can compromise credentials or move laterally within the environment.

IOC Summary

Threat: script Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: script
let malicious_domains = dynamic(["45.196.97.80"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.196.97.80"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios: URLhaus: Script Malicious URLs

• Scenario: Automated CI/CD Pipeline Artifact Downloads

  • Context: DevOps teams using Azure DevOps or GitHub Actions often trigger automated build agents to download script artifacts (e.g., .ps1, .sh) from internal artifact repositories hosted on domains that may be newly registered or shared with public CDNs. These downloads mimic the “malicious script execution” and “unexpected network connections” logic of the rule, especially when the pipeline runs during off-hours.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for specific CI/CD service accounts (e.g., svc-build-agent) and their associated IP ranges. Additionally, filter out traffic destined for known artifact storage domains (e.g., artifacts.company.com, github-releases.githubusercontent.com) where the User-Agent string contains “AzurePipelines” or “GitHub-Hook”.

• Scenario: Scheduled RMM Script Execution via Remote Management

  • Context: Enterprise IT operations rely on Remote Monitoring and Management (RMM) tools like ManageEngine Desktop Central, Lansweeper, or PDQ Deploy. These tools routinely push scheduled scripts to endpoints for patching, inventory collection, or configuration updates. The RMM server often hosts these scripts on a dedicated domain that the detection engine may flag as “compromised” due to dynamic DNS records or shared hosting environments.
  • Suggested Filter/Exclusion: Exclude traffic originating from the RMM server’s IP range and filter events where the parent process is the specific RMM agent (e.g., DesktopCentralAgent.exe, PDQDeploy.exe). Ensure the exclusion applies to script execution paths located within the standard tool installation directory (e.g., C:\Program Files\ManageEngine\...).

• **Scenario: Third-Party SaaS Integration Webhooks