URLhaus: sh Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints access newly identified malicious URLs tagged by the ‘sh’ (shell) category in the URLhaus threat intelligence feed, indicating potential command-and-control or shell script execution activities. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the malware executes its payload on internal systems.

IOC Summary

Threat: sh Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: sh
let malicious_domains = dynamic(["176.65.148.145.ptr.pfcloud.network", "176.65.148.145", "45.135.194.70.ptr.pfcloud.network"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.148.145.ptr.pfcloud.network", "176.65.148.145", "45.135.194.70.ptr.pfcloud.network"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: sh Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled PowerShell Script Execution via Admin Workstations

  • Context: Enterprise administrators often use scheduled tasks (e.g., Windows Task Scheduler) to run .ps1 or .sh scripts that fetch configuration updates from internal repositories. If the script downloads a manifest file tagged with “sh” (shell script) and the URL is newly added to the threat feed, it may trigger this rule despite being benign.
  • Filter/Exclusion: Exclude URLs containing internal domain suffixes (e.g., *.internal.corp or .local) from the detection scope. Additionally, add a filter for source IPs belonging to the “Admin_Workstations” security group when the destination port is 443 and the user agent contains “PowerShell”.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps tools like Jenkins or GitLab Runners frequently execute shell scripts (.sh) during build pipelines to pull dependencies from public registries (e.g., GitHub Actions, Docker Hub). These automated jobs often generate unique, ephemeral URLs that URLhaus may flag as “malicious” due to the high volume of new script downloads in a short window.
  • Filter/Exclusion: Create an exclusion for source hosts identified as CI/CD agents (e.g., jenkins-node-01, gitlab-runner). Filter out detections where the HTTP request header X-CI-Pipeline is present or the user agent string includes “Jenkins” or “GitLab”.

• Scenario: Endpoint Management Tool Policy Updates

  • Context: Tools like Microsoft Intune, SCCM (Configuration Manager), or Jamf often push policy updates via