URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where endpoints interact with five distinct ASCII-tagged malicious URLs identified by URLhaus, signaling potential command-and-control communication or phishing attempts. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before these known threats can exfiltrate sensitive data or deploy additional payloads.

IOC Summary

Threat: ascii Total URLs: 5 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["algi-english.4lima.at"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["algi-english.4lima.at"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: ascii Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Tool Updates & Telemetry

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently query the URLhaus API (https://urlhaus-api.abuse.ch/v1/url/) to fetch real-time threat intelligence feeds. These queries often contain ASCII-encoded URLs that match the rule’s signature but represent legitimate health checks rather than user-initiated malicious browsing.
  • Suggested Filter: Create an exclusion based on the source_host or process_name. Exclude traffic originating from known security service executables (e.g., C:\Program Files\CrowdStrike\fs_qrte.exe, MsMpEng.exe) where the destination URL contains urlhaus-api.abuse.ch or similar threat intelligence endpoints.

• Scenario: Scheduled Backup and Reporting Jobs

  • Context: Enterprise data backup solutions such as Veeam Backup & Replication, Rubrik, or Commvault run scheduled jobs that generate detailed logs or push reports to external cloud storage (e.g., AWS S3, Azure Blob). These jobs often construct ASCII URLs pointing to report artifacts or log repositories which may be flagged by the rule if the URL structure resembles known malicious patterns.
  • Suggested Filter: Implement a time-based exclusion for specific service accounts running backup tasks. For example, exclude events where process_name matches VeeamBackupService.exe and the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC), or filter by destination domain if the URL points to a known internal reporting subdomain.