URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving specific malicious URLs flagged by URLhaus with the tag 54e64e, which often indicate active phishing campaigns or command-and-control infrastructure. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before broader network impact occurs.

IOC Summary

Threat: 54e64e Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 54e64e Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Internal security appliances (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) perform periodic connectivity tests by querying known threat intelligence feeds. The URL https://urlhaus-api.io/api/v1/url/54e64e might be part of a scheduled health check that mimics the structure of the malicious signature.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from specific internal IP ranges (e.g., 10.20.30.0/24) or hostnames containing “security-scanner” where the destination URL contains /api/v1/ and the HTTP method is GET.

• Scenario: Scheduled Software Update Verification

  • Context: Enterprise endpoint management tools like Microsoft Intune or Jamf Pro run nightly jobs to verify update manifest integrity. These agents often fetch metadata from external repositories that may utilize the same hash prefix (54e64e) for versioning, triggering a match even though the content is benign.
  • Filter/Exclusion: Exclude events where the user agent string contains “IntuneManagementExtension” or “JamfProAgent” and the destination port is 443, provided the request originates from the corporate DMZ subnet (192.168.50.0/24).

• Scenario: Admin-Driven Threat Intelligence Integration

  • Context: The Security Operations Center (SOC) team manually runs a bulk import job using Splunk Add-on for URLhaus or Tenable One. During these scheduled maintenance windows, the system queries the specific