URLhaus: 64-bit Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging 64-bit specific malicious URLs to execute payloads or establish command-and-control channels, often indicating a targeted attack against modern x64 architectures. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic anomalies before the malicious URLs are rotated or blocked, reducing the mean time to detection for high-severity threats.

IOC Summary

Threat: 64-bit Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 64-bit
let malicious_domains = dynamic(["91.92.42.84", "85.11.167.41"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.42.84", "85.11.167.41"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses Terraform or Ansible to deploy a new microservice, where the image or artifact field in the configuration file points to a specific versioned URL (e.g., https://registry.example.com/v2/app/64-bit/latest) that matches the known malicious URL pattern due to a shared CDN or registry path.

  • Filter/Exclusion: Exclude alerts where the source process is terraform.exe, ansible-playbook.exe, or kubectl.exe, and the URL path contains standard versioning identifiers like /v2/, /latest, or /sha256/.

• Scenario: A system administrator runs a scheduled PowerShell script to patch a legacy application, which downloads a 64-bit installer from a vendor’s update server. The vendor’s update endpoint uses a URL structure that coincidentally matches the malicious URL (e.g., https://updates.vendor.com/win64/setup.exe).

  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or pwsh.exe and the URL domain is in the trusted vendor allowlist (e.g., *.vendor.com), and the file extension is .exe or .msi.

• Scenario: A QA engineer uses Selenium or Playwright for automated browser testing, where a test case navigates to a staging environment URL that mirrors the production malicious URL structure (e.g., https://staging.app.com/api/v1/64-bit/resource).

  • Filter/Exclusion: Exclude alerts where the source process is chromedriver.exe, geckodriver.exe, or node.exe (running Playwright/Puppeteer), and the URL contains staging, test, or dev in the hostname or path.