URLhaus: BillGates Malicious URLs

Hunt Hypothesis

This rule detects the BillGates malware family, a downloader and backdoor that establishes persistence and exfiltrates data through encrypted channels, typically delivered via phishing or compromised websites. Proactively hunting for these malicious URLs allows the SOC team to identify early-stage infections and lateral movement attempts before the adversary fully establishes a foothold in the Azure environment.

IOC Summary

Threat: BillGates Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: BillGates
let malicious_domains = dynamic(["194.59.31.5"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["194.59.31.5"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A marketing team uses a URL shortener service (e.g., Bitly or TinyURL) to track click-through rates for a corporate newsletter, where the shortened link resolves to a known BillGates domain used for A/B testing or legacy campaign tracking.
  • Filter/Exclusion: Exclude URLs where the user agent string contains Mozilla/5.0 and the referrer header is from the internal marketing automation platform (e.g., Marketo or HubSpot), or whitelist specific shortener domains if the resolved IP is internal.
• Scenario: An IT administrator runs a scheduled PowerShell script to validate DNS records or test connectivity to a staging environment that temporarily mirrors a BillGates domain for load balancing failover testing.
  • Filter/Exclusion: Exclude connections originating from service accounts (e.g., svc-dns-validator) or specific hostnames designated for network testing (e.g., test-node-01.corp.local), and filter out traffic on non-standard ports (e.g., 8080) if the BillGates domain is accessed via HTTP instead of HTTPS.
• Scenario: A developer uses a local proxy tool like Charles Proxy or Fiddler to intercept and inspect HTTPS traffic during web application development, which may log or cache URLs from a BillGates domain used in a mock API response or test fixture.
  • Filter/Exclusion: Exclude events where the process name is charles.exe, fiddler.exe, or mitmproxy, and the destination IP is within the local development subnet (e.g., 192.168.10.0/24), or filter out user agents containing Charles/4.6 or Fiddler/5.0.
• Scenario: A security team performs a controlled phishing simulation exercise using a tool like Gophish