URLhaus: stego Malicious URLs

Hunt Hypothesis

This rule identifies potential steganography-based malicious URLs from the URLhaus dataset, a technique adversaries use to hide payloads or commands within seemingly benign files to evade detection. Proactively hunting for these indicators in Azure Sentinel allows the SOC to uncover hidden lateral movement or command-and-control channels before they are leveraged for data exfiltration or persistence.

IOC Summary

Threat: stego Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: stego
let malicious_domains = dynamic(["104.250.238.131"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["104.250.238.131"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legacy Application Health Checks

  • Context: A legacy internal web application (e.g., built on older ASP.NET or PHP frameworks) uses a hardcoded health check endpoint that points to a deprecated, now-stego-tagged URL on URLhaus to verify external connectivity or fetch configuration snippets. The application’s cron job or scheduled task (Task Scheduler on Windows or crontab on Linux) hits this URL every 5 minutes.
  • Filter/Exclusion: Exclude the specific source IP range of the legacy application server (e.g., 10.20.5.10) or the specific user agent string associated with the legacy app (e.g., User-Agent: LegacyApp/1.0) when the destination URL matches the known stego hash.

• Scenario: CI/CD Pipeline Artifact Verification

  • Context: A Jenkins or GitLab CI pipeline includes a step to verify the integrity of a third-party dependency by fetching a checksum from a public repository. If the repository maintainer has not updated their URL after a domain migration, the pipeline may still reference an old URL that has since been tagged as stego due to a compromised subdomain. The build agent (e.g., jenkins-agent-01) initiates the HTTP GET request.
  • Filter/Exclusion: Exclude traffic from the CI/CD build agent service account (e.g., svc-ci-pipeline) or filter by the specific CI/CD job name (e.g., job_name: "build-and-test") if the source port is ephemeral and the destination port is 443/80.

• Scenario: Developer Local Testing with Staging Environments

  • Context: A developer is testing a new feature that involves redirecting users to a staging environment. The staging environment’s DNS record