URLhaus: stego Malicious URLs

Hunt Hypothesis

This rule detects adversaries embedding malicious payloads within images or documents using steganography to bypass traditional signature-based defenses and deliver hidden threats via compromised URLs. A SOC team should proactively hunt for this behavior in Azure Sentinel because steganographic attacks often evade standard URL filtering, requiring deep inspection of traffic patterns and file metadata to uncover concealed command-and-control channels before they compromise the network.

IOC Summary

Threat: stego Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: stego
let malicious_domains = dynamic(["hindustancargologistic.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["hindustancargologistic.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: stego Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanning Tools Accessing Known Stegography Repositories

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe public repositories hosting steganography samples for testing purposes. These tools often generate high-volume requests to URLs containing stego-specific parameters that mimic the rule’s signature, triggering false alerts during scheduled scans.
  • Filter/Exclusion: Create an exclusion based on the Source IP range of the security scanning appliances (e.g., 10.20.30.0/24) or filter out traffic where the User-Agent string contains specific keywords like “Tenable,” “Qualys,” or “Rapid7.”

• Scenario: Scheduled Data Backup Jobs Utilizing Cloud Storage with Stego-Enhanced Metadata

  • Context: Automated backup solutions (e.g., Veeam, Commvault, or Rubrik) often upload large datasets to cloud storage providers (like AWS S3 or Azure Blob) that utilize steganographic techniques for metadata embedding. The scheduled jobs running nightly may hit URLs with complex query strings resembling the malicious pattern defined in the rule.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:00 - 05:00 UTC) combined with an exclusion for destination domains known to be part of the backup infrastructure (e.g., *.veeam.com, *.azureedge.net).

• Scenario: Digital Asset Management (DAM) Systems Processing Watermarked Media

  • Context: Internal DAM platforms (such as **Adobe