URLhaus: xworm Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of XWorm malware through compromised web resources that generate traffic to known malicious URLs within the Azure Sentinel environment. Proactive detection is critical because XWorm infections often spread rapidly via network shares and email attachments, requiring immediate identification of these specific URL patterns to contain lateral movement before it impacts broader organizational assets.

IOC Summary

Threat: xworm Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: xworm
let malicious_domains = dynamic(["americanmanchester.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["americanmanchester.org"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: xworm Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Software Update Scans by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform background checks against known threat intelligence feeds. These agents may query the xworm URL repository to validate their own signature databases or check for new definitions, triggering a “hunt package” event that mimics an active infection scan.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts (e.g., svc-defender-updates) or restrict the rule scope to exclude known internal IP ranges of the Endpoint Management Server cluster where these background scans originate.

• Scenario: Scheduled Compliance and Vulnerability Assessment Scans

  • Context: Security teams often run scheduled vulnerability assessments using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM. These scanners probe external resources to validate URL categorization and threat posture, generating HTTP requests that match the xworm signature pattern as part of a routine “health check” rather than user activity.
  • Filter/Exclusion: Create an exclusion based on the User-Agent string containing specific scanner identifiers (e.g., Tenable-Nessus, Qualys-CloudAgent) or whitelist the source IP addresses assigned to the vulnerability management infrastructure during their scheduled maintenance windows (e.g., Sundays 02:00–04:00 UTC).

• Scenario: IT Helpdesk Remote Support and Patch Deployment Sessions

  • Context: During remote troubleshooting sessions, IT administrators use tools like Ivanti Endpoint Manager or Microsoft SCCM to push patches or run diagnostic scripts on user workstations. These administrative tasks often involve downloading configuration manifests or checking threat feeds via the x