URLhaus: dropped-by-Phorpiex Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where threat actors leverage newly identified malicious URLs flagged by Phorpiex to deliver payloads or redirect victims to compromised web resources. The SOC team should proactively investigate these indicators in Azure Sentinel because early detection of these high-severity, recently dropped URLs allows for immediate containment before they are widely exploited across the organization’s network.

IOC Summary

Threat: dropped-by-Phorpiex Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: dropped-by-Phorpiex
let malicious_domains = dynamic(["178.16.55.240"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["178.16.55.240"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: dropped-by-Phorpiex Malicious URLs rule, along with targeted filters and exclusions:

• Scenario: Automated Vulnerability Scanners Probing Known Bad Domains

  • Context: Enterprise vulnerability management tools like Tenable Nessus, Qualys, or Rapid7 InsightVM often perform active scanning against external assets. These scanners may attempt to resolve and connect to a wide range of domains, including those previously flagged by Phorpiex (a major malware research group) as “dropped” but currently benign in the scanner’s context.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host Name or Process Name. Filter out alerts where the initiating process is nessus.exe, qualysdvc.exe, or rapid7-agent.exe and the user account is a dedicated service account (e.g., svc-vuln-scanner).

• Scenario: Scheduled Antivirus Definition Updates via Cloud Repositories

  • Context: Endpoint Protection platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently pull definition updates from cloud repositories. These update servers often host URLs that have been previously analyzed by Phorpiex and tagged, causing the detection engine to flag the legitimate download traffic as malicious.
  • Filter/Exclusion: Implement a filter on the Destination URL Domain. Exclude specific domains known for hosting security definitions (e.g., *.microsoft.com, *.crowdstrike.com, *.symantec.com) or exclude alerts where the HTTP status code is 200 OK and the traffic volume exceeds 1MB, indicating a bulk download rather than a user interaction.

• Scenario: Admin-Driven Cloud Backup and Synchronization Jobs