URLhaus: BillGates Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the exploitation of trusted “Bill Gates” branding to deliver malicious payloads via phishing or drive-by attacks using known compromised URLs. A SOC team should proactively hunt for this in Azure Sentinel because leveraging URLhaus intelligence allows for the immediate identification and containment of high-severity threats that mimic legitimate sources, thereby reducing the risk of initial access compromises.

IOC Summary

Threat: BillGates Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: BillGates
let malicious_domains = dynamic(["194.59.30.63"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["194.59.30.63"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the specific false positive scenarios and corresponding filters for the URLhaus: BillGates Malicious URLs detection rule in an enterprise environment:

• Scenario 1: Scheduled Security Scans by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, perform periodic outbound connectivity checks to validate their cloud communication. These agents often query the urlhaus.abuse.ch feed directly or via a proxy to fetch threat intelligence updates, triggering hits on the BillGates tagged URLs during these automated health checks.
  • Suggested Filter: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike, defender-agent) or filter by process name if the detection includes process metadata (e.g., process_name IN ('csfalcon.exe', 'MsMpEng.exe')).

• Scenario 2: Admin Manual Verification via Browser

  • Context: Security analysts or IT administrators manually investigate new threats by visiting the URLhaus dashboard or specific BillGates threat pages in their web browsers (e.g., Google Chrome, Microsoft Edge) to verify IOCs before adding them to blocklists. This manual browsing activity generates legitimate HTTP/HTTPS requests that match the rule’s signature.
  • Suggested Filter: Create an exclusion for traffic initiated by user accounts within a specific security group, such as SG-Security-Admins or IT-Ops, and restrict the filter to business hours (e.g., 08:00–18:00) if manual checks are primarily performed during workdays.

• Scenario 3: Automated Threat Intelligence Feeds Ingestion

  • Context: The enterprise utilizes a Security Information and Event Management (SIEM) or threat intelligence platform like **Splunk