URLhaus: fakemas Malicious URLs

Hunt Hypothesis

This rule detects the use of known Fakemas phishing URLs, which adversaries deploy to host credential harvesting pages or deliver initial payloads to compromise user sessions. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify active or recent phishing attempts in user activity logs, enabling rapid containment before attackers escalate privileges or exfiltrate data.

IOC Summary

Threat: fakemas Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: fakemas
let malicious_domains = dynamic(["workerstats.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["workerstats.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security team or DevOps engineer uses a browser-based URL shortener or link preview tool (e.g., Bitly, TinyURL, or a custom internal service) to test or share a link that happens to be hosted on a domain currently listed in the URLhaus “fakemas” category due to a recent takedown or false flag.

  • Filter/Exclusion: Exclude traffic where the User-Agent string contains “Mozilla” and the request method is GET with a status code of 200 or 301, specifically if the source IP is within the corporate internal subnet (e.g., 10.0.0.0/8) and the destination port is 443. Alternatively, whitelist known internal link-preview services by their specific subdomain (e.g., preview.internal.corp.com).

• Scenario: An automated vulnerability scanner or web crawler (e.g., Qualys, Nessus, or Acunetix) is running a scheduled job that probes external endpoints, including known malicious URLs, to verify reachability or check for changes in response headers as part of a baseline audit.

  • Filter/Exclusion: Exclude alerts where the source hostname matches the naming convention of the scanning appliance (e.g., qualys-scan-01.corp.local) or where the User-Agent string contains “Nessus”, “Qualys”, or “Acunetix”. Additionally, exclude if the request occurs during a defined maintenance window (e.g., 02:00-04:00 UTC) and the source IP is in the designated management VLAN.

• Scenario: A legacy application or third-party SaaS integration (e.g., an old CRM plugin or a marketing automation tool like HubSpot or Marketo) is configured with a hardcoded callback URL or tracking pixel that points to a domain recently added to