URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving the execution or access of four specific ASCII-tagged malicious URLs known to host threats such as malware and phishing campaigns. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistence within the network.

IOC Summary

Threat: ascii Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["hotelmate.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["hotelmate.asia"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding filtering strategies for the URLhaus: ascii Malicious URLs rule in an enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Internal security appliances like CrowdStrike Falcon, Trend Micro Apex One, or SentinelOne frequently ping external URLhaus endpoints to verify connectivity and fetch the latest threat intelligence feeds. These tools often generate HTTP requests that match the “ascii” signature pattern but are benign administrative traffic.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host or Process Name. Exclude traffic originating from specific security agent processes (e.g., FalconSensor.exe, tmagent.exe) or whitelist the specific IP ranges of your internal threat intelligence gateways.

• Scenario: Scheduled Software Update Manifest Downloads

  • Context: Enterprise management tools such as Microsoft System Center Configuration Manager (SCCM) or Jamf Pro run scheduled jobs to download update manifests and release notes from vendor repositories. These downloads often contain ASCII-formatted URLs in the response headers that trigger the detection logic during nightly maintenance windows.
  • Filter/Exclusion: Implement a time-based filter to exclude detections occurring between 01:00 and 05:00 local time for known update service accounts (e.g., NT SERVICE\ccmexec). Alternatively, whitelist the specific destination domains of major software vendors (e.g., *.update.microsoft.com, *.jamfsoftware.com).

• Scenario: Legacy Reporting Tool Data Ingestion

  • Context: Business Intelligence tools like Tableau Server, Power BI Gateway, or custom internal reporting scripts often ingest data from external CSV feeds containing ASCII URL references. When these services parse and validate the links within the feed, they may generate network traffic that mimics malicious URL