URLhaus: minecraft Malicious URLs

Hunt Hypothesis

This hunt targets the use of nine known malicious URLs associated with the “minecraft” tag from URLhaus, which adversaries frequently leverage for initial access, payload delivery, or command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious web traffic before the malicious URLs are rotated or blocked, reducing the window of exposure for high-severity threats.

This hunt targets the use of nine known malicious URLs associated with the “minecraft” tag from URLhaus, which adversaries frequently leverage for initial access, payload delivery, or command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious web traffic before the malicious URLs are rotated or blocked, reducing the window of exposure for high-severity threats.

IOC Summary

Threat: minecraft Total URLs: 9 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: minecraft
let malicious_domains = dynamic(["dfdghfhddhdhfhdfhdfyhdfdfh.pages.dev", "thisisafalsepositive.st"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["dfdghfhddhdhfhdfhdfyhdfdfh.pages.dev", "thisisafalsepositive.st"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a local Minecraft server (e.g., localhost:25565 or an internal IP like 192.168.1.50:25565) for testing game logic or hosting a private team event, where the URLhaus rule might flag the specific port or domain if it matches a known malicious pattern (e.g., minecraft.example.com:25565 if that specific subdomain is in the hunt list).

  • Filter/Exclusion: Exclude URLs where the host resolves to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or ends with .local / .internal TLDs, and specifically whitelist known internal Minecraft server hostnames (e.g., mc-server-01.corp.local).

• Scenario: A QA team or automated testing pipeline (e.g., Jenkins, GitLab CI) runs integration tests against a staging environment that includes a mock Minecraft API endpoint or a game server container (e.g., mc-staging.prod-env.com:25565) to validate network connectivity or latency, triggering the rule if the staging domain is included in the malicious URL list.

  • Filter/Exclusion: Exclude URLs where the source process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner, docker-compose) or where the destination domain matches staging patterns (e.g., *.staging.*, *.test.*, *.dev.*).

• Scenario: An employee or IT admin uses a Minecraft-based educational or team-building tool (e.g., “Minecraft Education Edition” or a custom internal app) that connects to