URLhaus: ascii Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging ASCII-encoded malicious URLs to obfuscate phishing links or command-and-control channels, a technique designed to evade simple string-based detection. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious user activity before the encoded payloads are fully executed or data is exfiltrated.

IOC Summary

Threat: ascii Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["tuiskr.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["tuiskr.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Automated API Health Checks or Synthetic Monitoring: Tools like New Relic, Datadog, or Pingdom often perform periodic HTTP/HTTPS requests to specific endpoints to verify service availability. If a monitoring agent is configured to check a legacy or deprecated endpoint that happens to match one of the ASCII-tagged URLs (e.g., a test server or a staging environment URL that was previously compromised but is now benign), it will trigger the rule.

  • Filter/Exclusion: Exclude source IPs belonging to the internal monitoring subnet (e.g., 10.20.50.0/24) or exclude specific user agents associated with monitoring tools (e.g., User-Agent: *Datadog* or *NewRelic*).

• Webhook Payloads from CI/CD Pipelines: Continuous Integration/Deployment platforms like Jenkins, GitLab CI, or Azure DevOps frequently send HTTP POST requests to webhooks for notifications or trigger builds. If a pipeline configuration includes a callback URL to a third-party service (e.g., a Slack webhook, a custom notification service, or a legacy API gateway) that matches the ASCII-tagged URL, the detection will fire.

  • Filter/Exclusion: Exclude traffic originating from known CI/CD controller nodes (e.g., hostnames matching jenkins-master-* or ci-runner-*) or exclude specific HTTP methods (e.g., POST) when the destination URL matches the known list and the source is an internal CI/CD IP range.

• Scheduled Backup or Sync Jobs: Enterprise backup solutions like Veeam, Commvault, or Rubrik may use HTTP/HTTPS APIs to communicate with cloud storage gateways or management consoles. If a scheduled job (e.g., a nightly sync to an S3-compatible endpoint or a local repository) uses a URL