URLhaus: honeypot Malicious URLs

Hunt Hypothesis

This rule detects potential compromise by identifying traffic to known malicious URLs that are actively used as honeypots to lure or verify attacker infrastructure. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify early-stage reconnaissance or beaconing activity before adversaries fully establish a foothold in the environment.

IOC Summary

Threat: honeypot Total URLs: 6 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: honeypot
let malicious_domains = dynamic(["208.84.102.192", "144.172.88.127", "209.92.170.225", "minpop.com", "103.79.185.121"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["208.84.102.192", "144.172.88.127", "209.92.170.225", "minpop.com", "103.79.185.121"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer or Site Reliability Engineer (SRE) is performing manual network diagnostics or verifying DNS resolution for a known compromised domain to validate remediation steps. They may use tools like curl, wget, or nslookup directly against the honeypot URL to confirm it is still active or to capture a response for a ticket.

  • Filter/Exclusion: Exclude alerts where the source process is a standard network utility (curl.exe, wget.exe, nslookup.exe, dig.exe) and the user account belongs to a privileged group (e.g., Domain Admins, SRE-Team, DevOps) with a recent login event.

• Scenario: A security researcher or blue team member is running a controlled test or “purple team” exercise to validate the detection rule itself. They intentionally browse to or script a request to the honeypot URL to ensure the SIEM/EDR pipeline captures the event correctly.

  • Filter/Exclusion: Exclude alerts where the source user account has a tag or attribute indicating “Security Testing” or “Purple Team,” or where the event occurs during a pre-scheduled maintenance window for security validation.

• Scenario: An automated backup or archival job (e.g., Veeam, Commvault, or a custom Python script) is scanning a shared drive or database that contains a list of “known bad URLs” or threat intelligence feeds. The job may inadvertently open or index the URL string, triggering a browser or HTTP client to resolve it.

  • Filter/Exclusion: Exclude alerts where the source process is associated with backup software (VeeamBackup.exe, commvault.exe, python.exe running from a service path) or where the parent process is a scheduled task service (TaskScheduler.exe) and the user account is a service account (e.g., `svc-back