Detect Malicious URL Answers By DNS Queries

Query

let URLHausOnlineRAW = externaldata (UHFeed:string) ["https://urlhaus.abuse.ch/downloads/csv_online/"] with(format="txt")
| where UHFeed !startswith "#"
| extend UHRAW=replace_string(UHFeed, '"', '')
| project splitted=split(UHRAW, ',')
| mv-expand id=splitted[0], dateadded=splitted[1], UHUrl=splitted[2], UHurl_status=splitted[3], UHlast_onlin=splitted[4], UHthreat=splitted[5], UHtags=splitted[6], UHLink=splitted[7], UHReporter=splitted[8]
| extend UHUrl = tostring(UHUrl)
| extend UHUrlDomain = tostring(parse_url(UHUrl).Host)
| project-away splitted;
DeviceNetworkEvents
| extend answers = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend answersext = todynamic(tostring(parse_json(AdditionalFields).answers))
| mv-expand answers
//| extend geo_Remote_answers = todynamic(tostring(geo_info_from_ip_address(answers).country))
| extend Type =
    case(
        answers matches regex @"^(\d{1,3}\.){3}\d{1,3}$", "IPv4",   // Matches IPv4 format
        answers matches regex @"^([a-fA-F0-9:]+)$", "IPv6",         // Matches IPv6 format
        answers contains ".", "URL",                                // Checks if it contains a dot (common in URLs)
        "Unknown"                                                      // Default case
    )
| where Type has "URL"
| extend tostring(answers)
| join kind=inner (URLHausOnlineRAW) on $left.answers == $right.UHUrl
| extend geo_Remote_ip = tostring(geo_info_from_ip_address(RemoteIP).country)
| project Timestamp,DeviceName,LocalIP,RemoteIP,geo_Remote_ip,MaliciousAnswers = UHUrl,answersext,UHUrlDomain, ActionType

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1071.004	Application Layer Protocol: DNS

Author: Sergio Albea (05/06/2026)

Detect Malicious URL answers by DNS queries

Description: The aim of this query is detect suspicious URL answers from DNS Queries, validating them with an external TI Feed and be alerted when there are some matches.

Explanation

This query is designed to detect potentially malicious URLs that are returned as answers in DNS queries. Here's a simplified breakdown of what the query does:

Fetch External Threat Intelligence Feed:
- The query retrieves data from an external source, URLHaus, which provides a list of known malicious URLs. This data is processed to remove any unnecessary characters and split into relevant fields such as URL, threat type, and other metadata.
Process Device Network Events:
- It examines network events from devices, specifically looking at DNS query responses. The query extracts the answers from these DNS queries and categorizes them based on their format (IPv4, IPv6, or URL).
Identify URLs:
- The query filters out the answers that are identified as URLs.
Match Against Threat Intelligence:
- It performs an inner join between the DNS query answers and the URLHaus feed to find matches. This means it identifies URLs in the DNS answers that are also listed as malicious in the URLHaus feed.
Output Results:
- For any matches found, the query outputs details such as the timestamp of the event, device name, local and remote IP addresses, the country associated with the remote IP, the malicious URL detected, and the domain of the URL.

In summary, this query helps in detecting and alerting on DNS queries that return URLs known to be malicious, using an external threat intelligence feed for validation.

Details

Sergio Albea

Released: July 21, 2026

Tables

DeviceNetworkEvents

Keywords

DeviceNetworkEventsDNSQueriesURL

Operators

letexternaldatawithwhere!startswithextendreplace_stringprojectsplitmv-expandtostringparse_urlproject-awayparse_jsoncasematches regexcontainshasjoinon

MITRE Techniques

T1071.004

Actions

GitHub

KQL Search