URLhaus: 0d20ad Malicious URLs

Hunt Hypothesis

This hunt targets potential compromise vectors by identifying traffic to five known malicious URLs associated with the URLhaus tag 0d20ad, which may indicate active exploitation or data exfiltration attempts. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect and isolate affected assets before adversaries can establish persistence or escalate privileges within the environment.

IOC Summary

Threat: 0d20ad Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 0d20ad
let malicious_domains = dynamic(["194.102.105.70"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["194.102.105.70"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a browser-based IDE or a CI/CD pipeline (e.g., Azure DevOps, GitHub Actions) to fetch a specific dependency or artifact from a staging environment that shares the same domain structure as the malicious URL, triggering the hunt package during a routine build.

  • Filter/Exclusion: Exclude traffic where the User-Agent contains ci-cd, jenkins, azure-devops, or github-actions, or restrict the rule to only trigger on interactive browser sessions (User-Agent contains Mozilla and Chrome/Firefox) rather than automated agents.

• Scenario: A security team or QA engineer performs a manual penetration test or vulnerability scan using tools like Burp Suite or OWASP ZAP, intentionally accessing the known malicious URL to verify WAF rules or logging behavior, which generates a legitimate hit.

  • Filter/Exclusion: Exclude sources where the User-Agent contains burp, zaproxy, nmap, or curl, or correlate with the source IP being part of the designated “Security Testing” or “QA” subnet range.

• Scenario: An administrator runs a scheduled PowerShell script or Python job to check the status of a legacy API endpoint that happens to be hosted on the same domain as the malicious URL (e.g., a shared staging server), causing the script to issue a GET request to the specific path.

  • Filter/Exclusion: Exclude requests where the User-Agent is python-requests, curl, Wget, or PowerShell, or filter out requests originating from service accounts (e.g., svc-automation, app-pipeline) rather than interactive user accounts.

• Scenario: A user bookmarks the malicious URL for reference during a threat hunting exercise or incident response documentation, and their browser automatically pre-fetches or loads the page when they navigate to their