URLhaus: MassLogger Malicious URLs

Hunt Hypothesis

This hunt targets the execution of the MassLogger infostealer, which is frequently distributed via malicious URLs to capture sensitive data such as credentials and browser information. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the exfiltration of corporate secrets and lateral movement within the network.

IOC Summary

Threat: MassLogger Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: MassLogger
let malicious_domains = dynamic(["107.150.72.207"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["107.150.72.207"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: An IT administrator manually tests a new internal staging environment or a specific application feature by navigating to a known test URL that happens to be listed in the MassLogger feed (e.g., a legacy demo page or a specific API endpoint used for load testing).

  • Filter/Exclusion: Exclude user agents containing Mozilla/5.0 combined with specific internal IP ranges (e.g., 10.0.0.0/8 or 192.168.1.0/24) if the URL is associated with internal staging environments. Alternatively, whitelist specific user accounts known to perform manual QA tasks (e.g., qa_admin, dev_lead).

• Scenario: A scheduled backup or synchronization job (e.g., using rsync, Veeam, or Windows Server Backup) pulls metadata or configuration files from a remote repository that includes a URL string matching the MassLogger pattern, possibly due to a shared configuration file or a cached index.

  • Filter/Exclusion: Exclude processes with names such as vss.exe, wbadmin.exe, rsync, or backup_agent when the source of the URL access is a service account (e.g., svc_backup, backup_svc).

• Scenario: A web application firewall (WAF) or reverse proxy (e.g., nginx, Apache, IIS) logs a request to a MassLogger URL because a client-side script or a third-party widget (like a chat bubble or analytics tracker) inadvertently references the malicious URL during a page load, even if the request is blocked or cached.

  • Filter/Exclusion: Exclude events where the user agent contains bot, crawler, or monitor (e.g., UptimeRobot, Pingdom, Site24x7) or where the HTTP status