URLhaus: hta Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging malicious .hta (HTML Application) files to execute payloads via compromised web links, a technique often used to bypass traditional email attachment defenses. Proactively hunting for these specific URLhaus-tagged indicators in Azure Sentinel is critical because .hta files can silently launch PowerShell or VBScript commands that may evade standard endpoint detection if not explicitly monitored at the network proxy level.

IOC Summary

Threat: hta Total URLs: 12 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: hta
let malicious_domains = dynamic(["107.175.202.168", "192.236.217.77", "192.236.217.68", "198.23.144.23", "107.172.247.123"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["107.175.202.168", "192.236.217.77", "192.236.217.68", "198.23.144.23", "107.172.247.123"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: hta Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Line-of-Business Application Deployment via PowerShell Scripts

  • Scenario: IT administrators frequently deploy updates to legacy internal applications (e.g., a custom HR portal built on older .NET frameworks) using scheduled PowerShell scripts. These scripts often invoke Invoke-WebRequest or Start-Process to download and execute .hta files from an internal file server (e.g., fileserver.corp.local) that hosts the application binaries. The URL structure may mimic known malicious patterns due to query parameters containing session tokens.
  • Suggested Filter: Create a whitelist exclusion for URLs originating from the internal IP range of the corporate file servers and specifically targeting the .hta extension. Additionally, exclude traffic where the User-Agent string matches PowerShell or specific service accounts (e.g., DOMAIN\svc_deploy).

• Microsoft System Center Configuration Manager (SCCM) Software Updates

  • Scenario: The SCCM infrastructure regularly pushes software updates and patches to endpoints. During this process, client agents download installation packages which may include .hta files for user notifications or configuration wizards from the internal Distribution Point servers. If these distribution points are hosted on public-facing subnets or use dynamic DNS names that resolve to external IPs, they might trigger the rule if the URL signature overlaps with known malicious patterns in the Hunt package.
  • Suggested Filter: Exclude URLs containing the domain suffix of your SCCM infrastructure (e.g., *.sccm.corp.local) and filter by the specific HTTP User-Agent associated with the SCCM Client (Microsoft-SoftwareUpdateAgent).

• Automated Browser-Based Reporting via Citrix or VDI Sessions

  • Scenario: In a Virtual Desktop Infrastructure (VD