URLhaus: SilentNet Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of SilentNet backdoor URLs, which indicate an adversary has established persistent remote access to execute commands and exfiltrate data. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised endpoints early, as the malware’s stealthy nature and phishing-based delivery mechanism often allow it to evade initial detection and maintain a long-term foothold in the environment.

IOC Summary

Threat: SilentNet Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: SilentNet
let malicious_domains = dynamic(["kryptonclient-donutsmp.com", "radium-client.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["kryptonclient-donutsmp.com", "radium-client.org"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Phishing Simulation Campaigns: Security teams often use tools like GoPhish or KnowBe4 to conduct internal awareness training. These platforms generate unique, short-lived URLs that may be flagged by URLhaus if the simulation infrastructure uses shared hosting or known benign-but-suspicious domains.
  • Filter/Exclusion: Exclude URLs containing specific campaign identifiers (e.g., /phish/, /training/) or whitelist the specific subdomains used by the internal phishing simulation platform (e.g., phish.internal.corp.com).
• Internal Developer Preview Environments: Developers frequently deploy staging or preview environments on cloud providers (e.g., Azure App Service, AWS Elastic Beanstalk) that use auto-generated, non-standard domain names or path structures. These URLs can appear “odd” or match generic patterns associated with SilentNet if they are accessed via external load balancers or public IPs.
  • Filter/Exclusion: Exclude URLs ending in common cloud provider suffixes (e.g., .azurewebsites.net, .cloudapp.net, .elasticbeanstalk.com) or those matching the internal CIDR ranges of the development VPCs.
• Scheduled Backup and Sync Jobs: Enterprise backup solutions like Veeam, Commvault, or rsync-based scripts often use temporary, dynamically generated URLs or tokens for secure transfer sessions. If these URLs are logged in proxy or firewall logs and contain long, random-looking path segments, they can mimic the obfuscated URL patterns of SilentNet.
  • Filter/Exclusion: Exclude URLs associated with known backup service accounts or specific API endpoints (e.g., /api/v1/backup/, /sync/token/) and correlate with source IPs belonging to the backup infrastructure subnet.
• Third-Party SaaS Integration Webhooks: Many SaaS platforms (e.g., Slack, Jira, Confluence) use unique, long-hash