URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This rule detects potential malware infections or command-and-control communications by identifying traffic to URLs associated with the d52f85 malware family, which may indicate compromised endpoints or lateral movement attempts. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate affected assets before the malware can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140", "panel.mkk9991999912.observer"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140", "panel.mkk9991999912.observer"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a new microservice, and the build process automatically generates a temporary staging URL (e.g., https://staging-api-prod-12345.s3.amazonaws.com/) that matches the pattern. The URL is used for automated smoke tests or health checks before the service is promoted to production.

  • Filter/Exclusion: Exclude URLs containing known staging prefixes (e.g., staging-, dev-, test-) or restrict the rule to exclude traffic from specific service accounts or IP ranges associated with CI/CD runners (e.g., 10.20.1.0/24).

• Scenario: An IT administrator runs a scheduled PowerShell script via Task Scheduler to back up application logs to an external object storage bucket. The script constructs a pre-signed URL for the upload (e.g., https://backup-bucket-xyz.blob.core.windows.net/logs/2024-05-20.zip?st=...&sp=...&se=...), which may inadvertently match the malicious URL pattern if the bucket name or path structure aligns with the rule’s regex.

  • Filter/Exclusion: Exclude URLs that contain query parameters typical of pre-signed URLs (e.g., st=, sp=, se=, sig=) or exclude domains ending in .blob.core.windows.net or .amazonaws.com if the enterprise uses these for legitimate backups.

• Scenario: A marketing team uses a third-party A/B testing tool (e.g., Optimizely or VWO) that injects JavaScript into web pages. The tool’s SDK fetches configuration data from a CDN URL (e.g., `https://cdn.optimizely.com/config/123456