URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This hunt targets the presence of three known malicious URLs associated with the URLhaus tag 54e64e, which adversaries may use for command-and-control channels or initial access vectors. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic before the malicious infrastructure is rotated or taken down.

IOC Summary

Threat: 54e64e Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) uses a hardcoded health check script that pings a specific external status endpoint (one of the 54e64e URLs) to verify upstream service availability. This occurs via a scheduled cron job or Windows Task Scheduler entry running every 5 minutes.

  • Filter/Exclusion: Exclude network connections where the source process is java.exe or javaw.exe and the destination IP/URL matches the specific 54e64e endpoint, provided the source user account is the service account (e.g., svc-legacy-app).

• CI/CD Pipeline Dependency Verification: A build server (e.g., Jenkins or GitLab Runner) executes a pre-build step that validates the reachability of a third-party API or CDN by making an HTTP GET request to one of the 54e64e URLs to confirm it is not blocked by the corporate firewall. This is triggered during nightly dependency update jobs.

  • Filter/Exclusion: Exclude alerts where the source host is a known CI/CD build node (e.g., jenkins-build-01) and the initiating process is curl.exe, wget.exe, or python.exe executing a specific script path like /opt/ci/scripts/check_deps.sh.

• Browser Extension Telemetry: A widely deployed enterprise browser extension (e.g., a custom SSO helper or password manager) sends periodic telemetry or license validation pings to one of the 54e64e URLs. This happens in the background for all users with the extension installed, often via the chrome.exe or msedge.exe process.

  • Filter/Exclusion: Exclude alerts where the source process is chrome.exe or msedge.exe and the user agent string contains