URLhaus: hta Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging malicious HTML Application (HTA) files to execute payloads via compromised web links, a technique often used to bypass standard browser security controls. Proactively hunting for these specific URLhaus-tagged indicators in Azure Sentinel is critical because HTA-based attacks frequently serve as initial infection vectors that can lead to rapid lateral movement and data exfiltration if not identified early.

IOC Summary

Threat: hta Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: hta
let malicious_domains = dynamic(["204.44.93.85", "192.236.217.77"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["204.44.93.85", "192.236.217.77"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: hta Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Admin Portal Access via HTA Scripts

  • Scenario: System administrators frequently access legacy internal management consoles (e.g., older versions of Microsoft System Center Configuration Manager (SCCM) or custom SharePoint intranet portals) that utilize .hta (HTML Application) files for dynamic dashboard rendering and interactive configuration wizards. When an admin navigates to these specific URLs, the browser downloads or executes a local HTA resource which triggers the URLhaus detection due to its association with known malicious patterns in public threat intelligence feeds.
  • Suggested Filter: Exclude traffic originating from the Administrators security group accessing internal IP ranges (e.g., 10.x.x.x) where the User-Agent contains “MSHTA” or the destination URL path includes /admin/hta/.

• Automated Patch Deployment via SCCM Task Sequences

  • Scenario: During scheduled maintenance windows, Microsoft Endpoint Configuration Manager (MECM) task sequences execute HTA-based scripts to report deployment status and gather hardware inventory. These scripts often fetch configuration manifests from internal distribution points that host .hta files. The detection logic flags these routine, high-volume HTTP requests as potential malicious URL activity because the specific URLs match signatures of known HTA exploit campaigns in the Hunt package.
  • Suggested Filter: Create an exclusion for source hosts identified as “SCCM Clients” (via asset tags) communicating with internal distribution point FQDNs during defined maintenance windows (e.g., 02:00–04:00 UTC), specifically filtering out URLs ending in .hta or containing tasksequence.

• Corporate Single Sign-On (SSO) Redirect Chains *