URLhaus: encrypted Malicious URLs

Hunt Hypothesis

This rule identifies the presence of known malicious URLs from the URLhaus database that are obfuscated or encrypted, indicating an adversary is likely using web-based payloads to establish initial access or exfiltrate data. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect stealthy web traffic patterns that may bypass standard signature-based detections, enabling early intervention against targeted phishing or drive-by download campaigns.

IOC Summary

Threat: encrypted Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: encrypted
let malicious_domains = dynamic(["drive.google.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drive.google.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget via a CI/CD pipeline (e.g., GitHub Actions, Jenkins) to fetch a configuration file or build artifact from a staging environment that is temporarily hosted on a URL flagged by URLhaus due to a recent, low-fidelity report or a shared infrastructure IP.

  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., agent.exe, jenkins-slave.jar, docker-cli) or where the command line contains specific flags like -o (output) or -L (follow redirects) combined with internal domain suffixes (e.g., .internal, .corp) or known staging subdomains.

• Scenario: A security team or blue team member performs a controlled test by visiting a known malicious URL from URLhaus in a sandboxed browser or using a tool like nmap or masscan to verify network egress rules, triggering the detection on the endpoint or proxy logs.

  • Filter/Exclusion: Exclude events where the user account belongs to a specific security group (e.g., SEC-BlueTeam, SOC-Testers) or where the process is a known network scanning tool (e.g., nmap.exe, masscan.exe, zmap.exe).

• Scenario: An automated backup or sync job (e.g., Veeam, Commvault, or a custom PowerShell script) retrieves metadata or a manifest file from a cloud storage endpoint that has been recently added to URLhaus due to a false positive or a compromised shared bucket, causing the URL to match the threat feed.

  • Filter/Exclusion: Exclude processes associated with known backup agents (e.g., VeeamBackup.exe, commvaultclient.exe) or scheduled tasks with names containing keywords like Backup, `