URLhaus: ACRStealer Malicious URLs

Hunt Hypothesis

Hunt package for 32 malicious URLs tagged as ACRStealer

IOC Summary

Threat: ACRStealer Total URLs: 32 Active URLs: 13

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ACRStealer
let malicious_domains = dynamic(["edge3dist.veloxunit.in.net", "gate2proxy.nuxbase.in.net", "room1dark.protovoda.in.net", "unitmed.goodwork.in.net", "link4access.optigrid.in.net", "main4point.nuxbase.in.net", "node2flow.veloxunit.in.net", "data3sync.nuxbase.in.net", "web1infra.nuxbase.in.net", "serv4base.veloxunit.in.net", "4wm0.woodflo.in.net", "unit1meta.veloxunit.in.net", "checkcipher.besthire.in.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["edge3dist.veloxunit.in.net", "gate2proxy.nuxbase.in.net", "room1dark.protovoda.in.net", "unitmed.goodwork.in.net", "link4access.optigrid.in.net", "main4point.nuxbase.in.net", "node2flow.veloxunit.in.net", "data3sync.nuxbase.in.net", "web1infra.nuxbase.in.net", "serv4base.veloxunit.in.net", "4wm0.woodflo.in.net", "unit1meta.veloxunit.in.net", "checkcipher.besthire.in.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus