URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious URLs tagged with the d52f85 signature, which often indicate active phishing or command-and-control communications. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before broader infection occurs.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: d52f85 Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to verify reachability and security posture. These tools often generate HTTP/HTTPS requests to known malicious URLs as part of their “active threat hunting” or “reputation checking” modules, triggering the rule despite no user interaction.
  • Suggested Filter: Exclude traffic originating from specific scanner service accounts or IP ranges (e.g., Source_IP IN [10.20.50.1-10.20.50.25]) where the User-Agent contains “Tenable” or “Qualys”.

• Scenario: Scheduled Backup and Sync Operations

  • Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync tools such as Microsoft OneDrive for Business often maintain persistent connections to external repositories. If a backup job is configured to fetch metadata or verify integrity against an external endpoint that has been recently flagged by URLhaus, the automated polling traffic will trigger the alert.
  • Suggested Filter: Create an exclusion based on Process_Name matching “VeeamBackupService.exe” or “OneDrive.exe” combined with a specific Destination_Port (e.g., 443) and time-based logic to exclude activity during known maintenance windows (e.g., Time BETWEEN 02:00 AND 06:00).

• Scenario: Admin-Driven Patch Management Verification

  • Context: System administrators frequently use tools like **Microsoft Endpoint Configuration Manager