URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving traffic to specific malicious URLs flagged by URLhaus with the tag d52f85, which often indicates active phishing campaigns or command-and-control communications. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before broader network impact occurs.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the URLhaus: d52f85 Malicious URLs detection rule:

• Scenario 1: Automated Security Tool Updates

  • Context: Enterprise security suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query URLhaus or similar threat intelligence feeds to update their local signature databases. The d52f85 tag often corresponds to a specific feed source used by these tools. When the agent performs its scheduled daily heartbeat or definition update, it generates an outbound connection to a URL matching this pattern, triggering the alert despite being benign.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\fs_qr.exe or MsMpEng.exe) and restrict the scope to Scheduled Task IDs associated with “Definition Updates.”

• Scenario 2: Cloud Backup and Synchronization Services

  • Context: Corporate backup solutions like Veeam, Acronis Cyber Protect, or OneDrive for Business often utilize URLhaus APIs to verify the integrity of cloud storage endpoints before initiating large data transfers. The d52f85 tag may represent a known safe endpoint used by these vendors for metadata retrieval. During peak backup windows (e.g., 02:00 AM), legitimate traffic to these URLs spikes, causing high-volume false positives.
  • Filter/Exclusion: Exclude the alert if the source IP belongs to the internal Backup Subnet (e.g., 10.50.x.x) and the destination URL contains known vendor domains such as *.acronis.com or *.veeam.com.

• Scenario 3: SIEM Log Ingestion and Threat Intelligence Enrichment

  • Context: