URLhaus: dropped-by-Phorpiex Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where threat actors utilize newly identified malicious URLs from the Phorpiex malware family to deliver payloads or redirect victims to phishing campaigns. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and block emerging threats before they compromise endpoints, leveraging the high severity of recently dropped URLs that may not yet be covered by standard signature-based defenses.

IOC Summary

Threat: dropped-by-Phorpiex Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: dropped-by-Phorpiex
let malicious_domains = dynamic(["178.16.54.109"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["178.16.54.109"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: dropped-by-Phorpiex Malicious URLs detection rule, including suggested filters and exclusions:

• Scenario: Automated Security Tool Health Checks

  • Context: Internal security tools like CrowdStrike Falcon, Trend Micro Apex One, or Microsoft Defender for Endpoint often perform periodic connectivity checks by pinging known malicious URL repositories (including Phorpiex feeds) to verify their own threat intelligence pipelines. These agents may generate HTTP GET requests to the specific dropped URLs as part of a “heartbeat” mechanism, triggering the rule despite no user interaction.
  • Filter/Exclusion: Create an exclusion based on the source process name and parent process ID. Exclude traffic where ProcessName matches FalconSensor.exe, TmMonitor.exe, or MsMpEng.exe AND ParentProcessName is a known system service (e.g., svchost.exe).

• Scenario: Scheduled Threat Intelligence Feed Synchronization

  • Context: Enterprise SIEMs or EDR management consoles often run scheduled jobs to ingest threat feeds. A nightly job using PowerShell scripts or Python automation tools might query the Phorpiex API endpoint directly to update local blocklists. If the script accesses a URL that has recently been “dropped” by Phorpiex but is still cached in the feed, it triggers the alert.
  • Filter/Exclusion: Exclude events where the source user account is a dedicated service account (e.g., svc-threat-intel or admin-automation) and the execution path contains keywords like \Scripts\, \Automation\, or \ScheduledTasks\.

• Scenario: Web Proxy Cache Refreshing

  • Context: Enterprise web proxies such as Zscaler, **Blue Coat (