First we are going to retrieve the URLhaus detailed database information containing online URLs. Let me show two examples using two data sources from URLhaus. The externaldata operator allows us to read data from an external storage such as a file hosted as a feed or stored as a blob in Azure blog storage.

Plain text URL list – online – c ontaining only online (active) malware URLsĪdvanced Hunting and the externaldata operatorĪdvanced hunting in Microsoft Defender ATP is based on the Kusto query language.

Plain text URL list – most recent additions from the past 30 days.Plain text URL list with all malware URLs known to URLhaus.Here there are several downloads available: Or just as plain text file with URLs only. You can also download the database in various formats such as a CSV file that contains the following information: You can browse the URL database interactively through The project provides several ways to find and retrieve information about malware URLs. URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution.

Hello everyone, in today’s article we are going to take look at how we can use Threat Intelligence (TI) data from URLhaus with Microsoft Defender ATP advanced hunting.

Ip address advanced