URLhaus: black3 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints access newly identified malicious web resources flagged by URLhaus with a “black3” severity tag, indicating active threats often associated with phishing or drive-by downloads. Proactively hunting for these specific URLs in Azure Sentinel is critical to rapidly isolate compromised assets and block lateral movement before the broader threat landscape updates its signature databases.

IOC Summary

Threat: black3 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: black3
let malicious_domains = dynamic(["digital.digitaldatainsights.org", "195.24.237.240"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["digital.digitaldatainsights.org", "195.24.237.240"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: black3 Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Software Update Agents (e.g., SCCM or Intune)

  • Scenario: Enterprise patch management tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune frequently pull update manifests and installer packages from vendor repositories. These vendors often host files on shared CDNs that have previously hosted compromised content, causing the URL to be flagged as black3 even though the specific download path is safe and the traffic originates from a known management server.
  • Filter/Exclusion: Create an exclusion for source IPs belonging to the Patch Management Server group (e.g., 10.x.x.x/24) accessing destination domains ending in .update.microsoft.com or specific vendor CDNs, provided the user agent string contains keywords like “SCCM” or “Intune”.

• Scheduled Compliance and Backup Scans (e.g., Veeam or Symantec)

  • Scenario: Scheduled backup jobs using tools like Veeam Backup & Replication or Symantec Endpoint Protection often initiate connections to external license validation servers or cloud storage gateways. If these legacy endpoints utilize older SSL certificates or share IP ranges with known malicious actors, the black3 tag may trigger during routine daily health checks initiated by the backup service account rather than a user interaction.
  • Filter/Exclusion: Exclude traffic where the source port is associated with the specific backup service (e.g., Veeam Agent) and the destination URL contains paths related to “license,” “validation,” or “cloud-gateway.” Additionally, filter out events occurring strictly during maintenance windows (e.g., 02:00–04:00 UTC).

• **IT Administration via Remote Management Tools (e.g