URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where endpoints access known malicious ASCII-tagged URLs from the URLhaus repository, signaling potential phishing campaigns or command-and-control communications. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before these high-severity threats can exfiltrate sensitive data or deploy additional payloads.

IOC Summary

Threat: ascii Total URLs: 5 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["178.16.53.176"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["178.16.53.176"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ascii Malicious URLs rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated vulnerability scanning by internal security tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) probing external web endpoints.

  • Context: These scanners frequently generate high volumes of HTTP/HTTPS requests to known public URLs for asset discovery and CVE checks, which may be flagged as “malicious” by URLhaus due to the nature of the scanned assets (e.g., legacy or newly registered domains).
  • Filter/Exclusion: Exclude traffic originating from specific scanner service accounts or IP ranges.
    • Implementation: Source_IP IN [10.20.5.10, 10.20.5.11] AND Source_User_Agent CONTAINS "Tenable" OR "Qualys"

• Scenario: Scheduled backup jobs utilizing cloud storage APIs (e.g., Veeam, Rubrik, or Azure Backup) accessing external S3 buckets or CDN endpoints.

  • Context: During nightly backup windows, the backup agents initiate thousands of connections to specific cloud provider URLs (e.g., *.blob.core.windows.net or *.s3.amazonaws.com). URLhaus may flag these generic cloud URLs if they have been recently added to a threat feed or possess high entropy.
  • Filter/Exclusion: Create an allow-list for known cloud storage domains and specific backup service accounts.
    • Implementation: Destination_URL CONTAINS ".blob.core.windows.net" OR ".s3.amazonaws.com" AND Source_Process_Name IN ["Veeam.Backup.Service", "AzureBackupAgent"]

• Scenario: Enterprise Endpoint Detection and Response (EDR) agents (e.g.,