URLhaus: gafgyt Malicious URLs

Hunt Hypothesis

This hunt targets the execution of known malicious URLs associated with the “gafgyt” tag, indicating potential web-based attacks or phishing campaigns that could lead to credential theft or malware delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or user sessions before the adversary can establish persistence or exfiltrate data.

IOC Summary

Threat: gafgyt Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: gafgyt
let malicious_domains = dynamic(["172.233.43.198"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["172.233.43.198"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security engineer or SOC analyst is actively testing the new “gafgyt” detection rule in a non-production environment or using a dedicated test account to verify alerting behavior.
  • Filter/Exclusion: Exclude alerts where the source user account matches known test accounts (e.g., svc-sec-test, user-qa-01) or where the source IP address belongs to the designated security lab subnet (e.g., 10.20.30.0/24).
• Scenario: An application deployment pipeline (e.g., Jenkins, Azure DevOps, or GitHub Actions) is running integration tests that involve fetching resources from the specific “gafgyt” URLs to validate external API connectivity or content integrity before a production release.
  • Filter/Exclusion: Exclude alerts originating from service accounts associated with CI/CD pipelines (e.g., svc-ci-cd, build-agent-01) or where the process name is a known build tool (e.g., java.exe, node.exe, powershell.exe invoked by jenkins.exe).
• Scenario: A network monitoring or web proxy appliance (e.g., Zscaler, Palo Alto Prisma Access, or Squid) is performing active health checks or cache validation against the known “gafgyt” URLs to ensure they are still reachable or to update its threat intelligence feed.
  • Filter/Exclusion: Exclude alerts where the source hostname matches the proxy or monitoring appliance (e.g., proxy-01.corp.local, zscaler-appliance-01) or where the user agent string contains identifiers like Zscaler-HealthCheck or Squid/3.x.
• Scenario: A scheduled PowerShell or Python script used for automated log analysis or threat hunting is iterating through a list of