Detect Malicious URL Answers By DNS Queries

Query

let URLHausOnlineRAW = externaldata (UHFeed:string) ["https://urlhaus.abuse.ch/downloads/csv_online/"] with(format="txt")
| where UHFeed !startswith "#"
| extend UHRAW=replace_string(UHFeed, '"', '')
| project splitted=split(UHRAW, ',')
| mv-expand id=splitted[0], dateadded=splitted[1], UHUrl=splitted[2], UHurl_status=splitted[3], UHlast_onlin=splitted[4], UHthreat=splitted[5], UHtags=splitted[6], UHLink=splitted[7], UHReporter=splitted[8]
| extend UHUrl = tostring(UHUrl)
| extend UHUrlDomain = tostring(parse_url(UHUrl).Host)
| project-away splitted;
DeviceNetworkEvents
| extend answers = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend answersext = todynamic(tostring(parse_json(AdditionalFields).answers))
| mv-expand answers
//| extend geo_Remote_answers = todynamic(tostring(geo_info_from_ip_address(answers).country))
| extend Type =
    case(
        answers matches regex @"^(\d{1,3}\.){3}\d{1,3}$", "IPv4",   // Matches IPv4 format
        answers matches regex @"^([a-fA-F0-9:]+)$", "IPv6",         // Matches IPv6 format
        answers contains ".", "URL",                                // Checks if it contains a dot (common in URLs)
        "Unknown"                                                      // Default case
    )
| where Type has "URL"
| extend tostring(answers)
| join kind=inner (URLHausOnlineRAW) on $left.answers == $right.UHUrl
| extend geo_Remote_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
| project Timestamp,DeviceName,LocalIP,RemoteIP,geo_Remote_ip,MaliciousAnswers = UHUrl,answersext,UHUrlDomain, ActionType

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1071.004	Application Layer Protocol: DNS

Author: Sergio Albea (14/03/2025)

Detect Malicious URL answers by DNS queries

Description: The aim of this query is detect suspicious URL answers from DNS Queries, validating them with an external TI Feed and be alerted when there are some matches.

Explanation

This query is designed to detect potentially malicious URLs that are returned as answers in DNS queries. It does this by comparing the URLs found in DNS query responses with a list of known malicious URLs from an external threat intelligence feed (URLHaus).

Here's a simplified breakdown of what the query does:

Load External Threat Intelligence Feed:
- The query first loads a list of known malicious URLs from an external source (URLHaus) and processes this data to extract relevant fields like the URL, date added, threat type, etc.
Process Device Network Events:
- It then examines network events on devices, specifically looking at DNS query responses to identify URLs.
Identify URL Answers:
- The query checks if the answers in DNS responses are URLs by looking for patterns typical of URLs (e.g., containing dots).
Match Against Malicious URLs:
- It compares these URLs against the list from the threat intelligence feed to find matches.
Output Results:
- If a match is found, it outputs details such as the timestamp, device name, local and remote IP addresses, the country associated with the remote IP, the malicious URL, and the action type.

In essence, this query helps in identifying and alerting on DNS responses that contain URLs known to be associated with malicious activity, aiding in the detection of potential security threats.

Details

Sergio Albea

Released: July 21, 2026

Tables

DeviceNetworkEvents

Keywords

DeviceNetworkEventsDNSQueriesURL

Operators

letexternaldatawithwhere!startswithextendreplace_stringprojectsplitmv-expandtostringparse_urlproject-awaytodynamicparse_jsoncasematches regexcontainshasjoinon

MITRE Techniques

T1071.004

Actions

GitHub

KQL Search