URLhaus: stego Malicious URLs

Hunt Hypothesis

This hypothesis targets the use of steganography techniques to embed malicious payloads within seemingly benign URLs, allowing adversaries to bypass traditional signature-based detection and exfiltrate data or deliver malware. Proactively hunting for these specific URLhaus entries in Azure Sentinel is critical to identify compromised endpoints that may have interacted with these obfuscated resources before they are rotated or added to blocklists.

IOC Summary

Threat: stego Total URLs: 6 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: stego
let malicious_domains = dynamic(["94.156.152.110", "155.103.69.104"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.156.152.110", "155.103.69.104"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Staging Environment for Web Application Testing

  • Scenario: A QA or DevOps team uses a local staging server (e.g., http://192.168.10.5:8080/legacy-app) to test a new feature that involves image steganography for hidden debug payloads or A/B testing variants. The application automatically fetches these specific test URLs to validate the stego extraction logic before deployment.
  • Filter/Exclusion: Exclude URLs where the host is an internal IP range (e.g., 10.0.0.0/8, 192.168.0.0/16) or where the user agent string contains QA-Staging or DevOps-Test.

• Automated Backup Verification Jobs

  • Scenario: A scheduled PowerShell or Python script runs nightly to verify backup integrity by fetching specific test images from a known internal repository (e.g., http://backup-repo.internal/test-stego.png). This image is intentionally created with steganographic metadata to ensure the backup pipeline correctly preserves file attributes and hidden data structures.
  • Filter/Exclusion: Exclude events where the process is powershell.exe or python.exe and the command line arguments contain backup-verify or integrity-check.

• Digital Asset Management (DAM) System Previews

  • Scenario: An enterprise DAM system (e.g., Bynder, Adobe Experience Manager) generates thumbnail previews for high-resolution images. Some marketing assets use steganography to embed copyright watermarks or metadata. The DAM service fetches these URLs from an internal CDN or object storage bucket (e.g., http://cdn.internal/assets/watermarked-logo.png) to render previews for users.
  • Filter/Exclusion: Exclude