URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving known malicious ASCII URLs that may indicate phishing campaigns or command-and-control communications leveraging text-based web resources. Proactive hunting in Azure Sentinel is essential to rapidly isolate these specific threats before they compromise endpoints through user interaction with high-severity external links.

IOC Summary

Threat: ascii Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["verifyidentify.com", "103.229.53.84", "akb.cat"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["verifyidentify.com", "103.229.53.84", "akb.cat"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: ascii Malicious URLs” Rule

• Scenario: Scheduled Security Tool Updates

  • Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or SentinelOne often trigger background update jobs during off-hours. These agents frequently query the vendor’s update servers (e.g., updates.crowdstrike.com or go.microsoft.com) which host ASCII-based configuration manifests and signature feeds that URLhaus may flag as “malicious” due to high traffic volume or shared IP ranges.
  • Suggested Filter: Exclude URLs containing specific vendor domains in the query logic (e.g., url contains ".crowdstrike.com" OR url contains ".microsoft.com"). Alternatively, create a whitelist rule for these specific FQDNs within the detection engine to suppress alerts during known maintenance windows.

• Scenario: Automated Compliance and Reporting Scripts

  • Context: Internal IT operations often rely on scheduled PowerShell or Python scripts (e.g., running via Task Scheduler or Ansible) that fetch compliance data from external regulatory bodies or cloud providers like AWS S3 buckets or Azure Storage. These scripts download ASCII-formatted logs, policy documents, or JSON reports. If the source URL is a generic public endpoint used by multiple tenants, URLhaus might classify it as suspicious due to its broad usage pattern.
  • Suggested Filter: Implement an exclusion based on the initiating process name (e.g., process_name contains "python.exe" OR process_name contains "powershell.exe"). Additionally, filter out URLs that match known internal regex patterns for compliance data endpoints (e.g., url matches ".*compliance-data.*.json$").

• Scenario: Legacy Application Data Synchronization

  • Context: Older enterprise applications (such as legacy ERP