URLhaus: ascii Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging ASCII-encoded malicious URLs to obfuscate phishing links or command-and-control channels, a technique often used to bypass basic URL filtering and evade signature-based detection. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious user activity early, reducing the dwell time of threats that exploit simple encoding schemes to hide their intent.

IOC Summary

Threat: ascii Total URLs: 12 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["drive.google.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drive.google.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A deprecated internal web application (e.g., a custom Java-based inventory system) uses a hardcoded ASCII URL for a specific API endpoint that was previously flagged by URLhaus due to a shared IP or domain reputation issue. The application’s health check script runs every 5 minutes via a Windows Task Scheduler job named AppHealthCheck.

  • Filter/Exclusion: Exclude network connections where the destination URL matches the specific ASCII string and the source process is java.exe or the specific application service executable (e.g., inventory-service.exe).

• CI/CD Pipeline Artifact Downloads: A Jenkins or Azure DevOps pipeline stage downloads a build artifact or dependency from a self-hosted Nexus repository or S3 bucket using a plain HTTP (ASCII) URL. The URL was temporarily added to URLhaus due to a misconfigured CDN or a shared hosting provider. The download is initiated by the wget or curl command executed within a Docker container or agent process.

  • Filter/Exclusion: Exclude events where the source process is curl.exe, wget.exe, or python.exe (if using urllib) and the destination domain matches the internal Nexus/S3 domain (e.g., nexus.internal.corp.com), even if the URL string is flagged.

• Database Replication or Sync Jobs: A SQL Server or PostgreSQL replication job uses a plain ASCII URL to fetch metadata or configuration files from a staging server. The URL was flagged due to a known vulnerability in the staging server’s web server (e.g., Apache Struts) that was later patched, but the URL remains in the URLhaus feed. The job runs via a scheduled sqlcmd or psql script.

  • Filter/Exclusion: Exclude connections where the source process is sqlcmd.exe or psql.exe and the destination IP is