category: Data Enrichment & Threat Intelligence provider: Open Source commonfields: id: URLhaus version: -1 sectionorder: - Connect configuration: - defaultvalue: https://urlhaus-api.abuse.ch/v1/ display: Server URL (e.g. https://192.168.0.1) name: url type: 0 required: false section: Connect - displaypassword: Auth Key hiddenusername: true name: credentials type: 9 section: Connect required: false additionalinfo: Starting June 30th 2025 this parameter is mandatory. - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - defaultvalue: 'true' display: Create relationships name: create_relationships type: 8 required: false section: Connect - additionalinfo: Maximal value is 1000. defaultvalue: '10' display: Maximum number of relationships to fetch per indicator name: max_num_of_relationships type: 0 required: false section: Connect - defaultvalue: '1' hidden: true display: Blacklists appearances threshold name: threshold type: 0 required: false section: Connect - display: Compromised (is malicious) hidden: true name: compromised_is_malicious type: 8 required: false section: Connect - additionalinfo: Determines how many times a command should be retried before raising an error. defaultvalue: '3' display: Number of retries name: retry type: 0 required: false section: Connect - name: should_error additionalinfo: Does the file command should error when using unsupported hash. display: Return Error type: 8 required: false defaultvalue: 'true' section: Connect description: URLhaus has the goal of sharing malicious URLs that are being used for malware distribution. display: URLhaus name: URLhaus script: commands: - arguments: - default: true description: A comma-separated list of URLs to query. isArray: true name: url required: true description: Retrieves URL information from URLhaus. name: url outputs: - contextPath: URL.Data description: The URL. type: string - contextPath: URL.Malicious.Vendor description: Vendor that reported the URL as malicious. type: string - contextPath: URL.Malicious.Description description: Description of the malicious URL. type: string - contextPath: URL.Tags description: A list of tags associated with the queried malware URL. type: string - contextPath: URL.Relationships.EntityA description: The source of the relationship. type: String - contextPath: URL.Relationships.EntityB description: The destination of the relationship. type: String - contextPath: URL.Relationships.Relationship description: The name of the relationship. type: String - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. type: String - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: String - contextPath: URLhaus.URL.ID description: Unique identifier of the URLhaus database entry. type: String - contextPath: URLhaus.URL.Status description: The current status of the URL. type: String - contextPath: URLhaus.URL.Host description: The extracted host of the malware URL (IP address or domain name/FQDN). type: String - contextPath: URLhaus.URL.DateAdded description: Date the URL was added to URLhaus. type: date - contextPath: URLhaus.URL.Threat description: The threat corresponding to this malware URL. type: String - contextPath: URLhaus.URL.Blacklist.Name description: Name of the block list. type: String - contextPath: URLhaus.URL.Tags description: A list of tags associated with the queried malware URL. type: String - contextPath: URLhaus.URL.Payload.Name description: Payload file name. type: String - contextPath: URLhaus.URL.Payload.Type description: Payload file type. type: String - contextPath: URLhaus.URL.Payload.MD5 description: MD5 hash of the HTTP response body (payload). type: String - contextPath: URLhaus.URL.Payload.VT.Result description: VirusTotal results for the payload. type: Number - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: URLhaus.URL.Blacklist.Status description: Status of the URL in the block list. type: String - contextPath: URLhaus.URL.Payload.VT.Link description: Link to the VirusTotal report. type: String - arguments: - default: true description: A comma-separated list of domains to query. isArray: true name: domain required: true description: Retrieves domain information from URLhaus. name: domain outputs: - contextPath: Domain.Name description: The domain name, for example, google.com. type: String - contextPath: Domain.Tags description: A list of tags associated with the queried malware domain. type: string - contextPath: Domain.Relationships.EntityA description: The source of the relationship. type: String - contextPath: Domain.Relationships.EntityB description: The destination of the relationship. type: String - contextPath: Domain.Relationships.Relationship description: The name of the relationship. type: String - contextPath: Domain.Relationships.EntityAType description: The type of the source of the relationship. type: String - contextPath: Domain.Relationships.EntityBType description: The type of the destination of the relationship. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: URLhaus.Domain.FirstSeen description: Date that the IP address was seen for the first time (UTC). type: Date - contextPath: URLhaus.Domain.Blacklist.Name description: The status of the domain in different block lists. type: String - contextPath: URLhaus.Domain.URL description: URLs observed on this domain. type: String - contextPath: Domain.Malicious.Vendor description: Vendor that reported the domain as malicious. type: String - contextPath: Domain.Malicious.Description description: Description of the malicious domain. type: String - contextPath: URLhaus.Domain.Blacklist.Status description: Status of the domain in the block list. type: String - arguments: - default: true description: A comma-separated list of MD5 or SHA256 hashes of the file to query. isArray: true name: file required: true description: Retrieves file information from URLhaus. name: file outputs: - contextPath: File.Size description: File size (in bytes). type: Number - contextPath: File.MD5 description: MD5 hash of the file. type: String - contextPath: File.SHA256 description: SHA256 hash of the file. type: String - contextPath: File.SSDeep description: SSDeep of the file. type: String - contextPath: File.Type description: Type of the file. type: String - contextPath: File.Relationships.EntityA description: The source of the relationship. type: String - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: String - contextPath: File.Relationships.Relationship description: The name of the relationship. type: String - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: String - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: String - contextPath: URLhaus.File.MD5 description: MD5 hash of the file. type: String - contextPath: URLhaus.File.SHA256 description: SHA256 hash of the file. type: String - contextPath: URLhaus.File.Type description: 'File type guessed by URLhaus, for example: .exe, .doc.' type: String - contextPath: URLhaus.File.Size description: File size (in bytes). type: Number - contextPath: URLhaus.File.Signature description: Malware family. type: String - contextPath: URLhaus.File.FirstSeen description: Date and time (UTC) that URLhaus first saw this file (payload). type: Date - contextPath: URLhaus.File.LastSeen description: Date and time (UTC) that URLhaus last saw this file (payload). type: Date - contextPath: URLhaus.File.DownloadLink description: Location (URL) where you can download a copy of this file. type: String - contextPath: URLhaus.File.VirusTotal.Percent description: 'AV detection (percentage), for example: 24.14.' type: Number - contextPath: URLhaus.File.VirusTotal.Link description: Link to the VirusTotal report. type: String - contextPath: URLhaus.File.URL description: A list of malware URLs associated with this payload (max. 100). type: Unknown - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - arguments: - default: true description: SHA256 hash of the file to download. name: file required: true description: Downloads a malware sample from URLhaus. execution: true name: urlhaus-download-sample outputs: - contextPath: File.Size description: File size. type: number - contextPath: File.SHA1 description: SHA1 hash of the file. type: string - contextPath: File.SHA256 description: SHA256 hash of the file. type: string - contextPath: File.Name description: File name. type: string - contextPath: File.SSDeep description: SSDeep hash of the file. type: string - contextPath: File.EntryID description: File entry ID. type: string - contextPath: File.Info description: File information. type: string - contextPath: File.Type description: File type. type: string - contextPath: File.MD5 description: MD5 hash of the file. type: string - contextPath: File.Extension description: File extension. type: string dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - Test_URLhaus fromversion: 5.0.0