This detection identifies adversary behavior where threat actors leverage newly identified malicious URLs from the Censys database to facilitate phishing campaigns or command-and-control communications within the network. A proactive hunt is essential in Azure Sentinel to immediately validate and block these high-severity indicators before they can compromise endpoints or exfiltrate sensitive data through unmonitored web traffic.
Threat: censys Total URLs: 35 Active URLs: 32
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://103.161.17.92/bins/chud.x86 | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.x86_64 | offline | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.ppc | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.mpsl | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.arm6 | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.aarch64 | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.arm7 | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.arm | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.arc | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.arm5 | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.m68k | online | malware_download | 2026-08-23 |
hxxp://103.161.17.92/bins/chud.mips | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.i686 | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.i486 | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.x86_64 | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.mips | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.powerpc | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.armv4l | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.i586 | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.mipsel | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.armv6l | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.armv7l | online | malware_download | 2026-08-23 |
hxxp://2.27.248.13/AGbot.armv5l | online | malware_download | 2026-08-23 |
hxxp://46.151.182.200/bot.i468 | offline | malware_download | 2026-08-23 |
hxxp://46.151.182.200/x86_64 | online | malware_download | 2026-08-23 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: censys
let malicious_domains = dynamic(["2.27.248.13", "103.161.17.92", "185.104.63.79", "46.151.182.200", "193.111.117.135"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["2.27.248.13", "103.161.17.92", "185.104.63.79", "46.151.182.200", "193.111.117.135"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: censys Malicious URLs rule, including tailored filters and exclusions suitable for an enterprise environment:
Scenario: Automated Vulnerability Scanning by Security Tools
TENSUS-SVC, QualysPC) or restrict the rule to only trigger during non-scan hours if the scan schedule is fixed.Scenario: Scheduled Software Update and Patching Jobs
WUAUService, ccmexec.exe, or IvantiPatchAgent during defined maintenance hours (e.g., 01:30-05:30).Scenario: Cloud Backup and Synchronization Services