URLhaus: hVNC Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of the hVNC backdoor, a tool frequently used by threat actors to establish covert remote access channels for command and control or data exfiltration. Proactively hunting for these known malicious URLs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary can leverage the backdoor for lateral movement or privilege escalation.

IOC Summary

Threat: hVNC Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: hVNC
let malicious_domains = dynamic(["windowsdiagnostics.st"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["windowsdiagnostics.st"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., built on older ASP.NET or Java frameworks) performs automated health checks or “ping” requests to external monitoring services or CDN endpoints that happen to be hosted on the same IP/domain as the hVNC malicious URLs.

  • Filter/Exclusion: Exclude traffic from specific service accounts or application pool identities (e.g., svc-legacy-app or app-health-checker) when the destination URL matches the known hVNC list, provided the source port is ephemeral and the user-agent string matches the legacy app’s default (e.g., Mozilla/5.0 (compatible; LegacyHealthCheck/1.0)).

• Scheduled Backup Verification Jobs: A scheduled PowerShell or Python script runs nightly to verify backup integrity by fetching metadata from a cloud storage endpoint or third-party backup verification service. If the backup provider’s CDN or API endpoint shares a domain or IP with the hVNC URL, the script’s HTTP GET request triggers the rule.

  • Filter/Exclusion: Exclude processes initiated by known backup agents (e.g., VeeamBackup.exe, CommvaultAgent.exe, or python.exe running verify_backup.py) when the destination URL is in the hVNC list and the request method is GET with a 200 OK response, ensuring no file download or execution occurs.

• Developer Localhost Proxying: A developer uses a local proxy tool (e.g., ngrok, localtunnel, or frp) to expose a local development server to the internet for testing. The proxy service assigns a temporary URL that may coincide with the hVNC domain, or the developer manually configures the proxy to route through a shared endpoint that matches the malicious URL.

  • Filter/Exclusion: Exclude traffic originating from developer workstations (