URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of ASCII-tagged malicious URLs that often serve as initial infection vectors or command-and-control channels within the network environment. Proactive hunting in Azure Sentinel is critical to rapidly isolate these specific threats and prevent lateral movement before they compromise sensitive data assets.

IOC Summary

Threat: ascii Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["drive.google.com", "xevzora.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drive.google.com", "xevzora.cfd"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ascii Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Patch Management Scans

  • Scenario: The WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) server initiates a scheduled job to download metadata and update definitions. These jobs often query internal repositories or third-party vendor sites that host large ASCII-based configuration files, which URLhaus may flag due to the sheer volume of ASCII traffic or shared IP reputation with known malicious actors.
  • Suggested Filter: Create an exclusion for the specific service account (e.g., svc-sccm-agent) and restrict the rule trigger to exclude URLs containing paths like /api/updates, /catalog/definitions, or specific internal FQDNs used by the patch management infrastructure.

• Enterprise Single Sign-On (SSO) Token Refresh

  • Scenario: During peak login hours, the Okta or Azure Active Directory (Entra ID) Identity Provider performs frequent token validation and session refresh requests. These interactions generate high-volume ASCII HTTP/HTTPS traffic to external identity endpoints. If these endpoints share IP ranges with known phishing campaigns, the “5 malicious URLs” threshold can be easily breached by legitimate authentication handshakes from a single user or service principal.
  • Suggested Filter: Exclude traffic originating from the Identity Provider’s known IP CIDR blocks (e.g., Okta-IP-Ranges) and filter out URL paths containing /oauth2, /saml/metadata, or /token to prevent routine SSO maintenance from triggering alerts.

• Legacy Application Health Checks

  • Scenario: A legacy Java-based Enterprise Resource Planning (ERP) system runs a cron job every 15 minutes to perform external health checks against vendor APIs (