URLhaus: MassLogger Malicious URLs

Hunt Hypothesis

This hypothesis targets adversary data exfiltration activities where MassLogger malware, often delivered via phishing or compromised domains, steals credentials and sensitive information from infected systems. Proactively hunting for these malicious URLs in Azure Sentinel is critical to identify compromised endpoints early and prevent the silent exfiltration of high-value assets before they are transmitted to attacker-controlled infrastructure.

IOC Summary

Threat: MassLogger Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: MassLogger
let malicious_domains = dynamic(["images.fishing-tools.cyou"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["images.fishing-tools.cyou"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A developer or DevOps engineer is testing a new application feature that involves dynamic URL generation or redirect chains, where the application logic temporarily constructs URLs matching known MassLogger patterns (e.g., specific path structures or query parameters) for load testing or debugging purposes.

  • Filter/Exclusion: Exclude hosts where the user agent string contains Postman, curl, or Python-urllib and the source IP is within the designated development or staging subnet ranges. Alternatively, whitelist specific application service accounts that perform automated URL validation tasks.

• Scenario: An IT administrator is manually verifying the resolution and content of a newly registered domain or a compromised domain that has been temporarily isolated for analysis. The admin opens the malicious URL in a browser to inspect headers or download the payload for reverse engineering, triggering the detection on the endpoint.

  • Filter/Exclusion: Exclude events where the process is a known browser (e.g., chrome.exe, msedge.exe) and the user belongs to the IT-Security-Analysis or SOC-Team AD group. Additionally, exclude if the destination IP is a known internal lab or sandbox IP range used for malware analysis.

• Scenario: A scheduled backup or synchronization job (e.g., using rsync, robocopy, or a custom Python script) is configured to pull data from a remote endpoint that uses a URL structure similar to MassLogger exfiltration channels (e.g., https://[domain]/upload?token=...). The job runs under a service account and accesses the URL as part of a legitimate data transfer.

  • Filter/Exclusion: Exclude events where the initiating process is a known file transfer tool (e.g., robocopy.exe, rsync, python.exe with specific script paths) and the user account is a known service account (e.g., `svc