URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This hunt targets the presence of two specific malicious URLs associated with the d52f85 tag, which adversaries may use for command-and-control channels or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or data exfiltration events before the threat actors can fully establish persistence or escalate privileges.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Web Application Testing and Fuzzing: Security teams or developers using tools like OWASP ZAP or Burp Suite may intentionally request known malicious URLs to verify WAF rules or test client-side validation.
  • Filter/Exclusion: Exclude source IPs belonging to the security-qa or dev-test subnets, or filter out requests where the User-Agent contains ZAP or Burp.
• Automated Link Checkers and Crawlers: Enterprise content management systems (e.g., SharePoint, Confluence) or SEO monitoring tools (e.g., Screaming Frog, Ahrefs) may crawl legacy pages or external resources that still reference the d52f85 URLs for broken link detection.
  • Filter/Exclusion: Exclude traffic from known crawler User-Agents (e.g., Screaming Frog, HeadlessChrome) or filter out requests where the HTTP method is HEAD (common for link checking) rather than GET/POST.
• Legacy API Integration or Webhooks: Older internal microservices or third-party integrations (e.g., Salesforce webhooks, ServiceNow integrations) might have hardcoded the malicious URL as a default endpoint or fallback before being updated.
  • Filter/Exclusion: Exclude specific application service accounts (e.g., svc-integration, api-gateway) or filter out requests originating from the integration-cluster namespace in Kubernetes.
• Browser History or Bookmark Sync: End-users who previously visited the malicious site may have it saved in their browser bookmarks or history, which syncs via Microsoft Edge or Chrome enterprise profiles, causing periodic re-requests if the browser auto-reloads or prefetches.
  • Filter/Exclusion: Exclude requests where the `