URLhaus: wraith Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known malicious URLs associated with the Wraith campaign, indicating potential web-based intrusion vectors or compromised endpoints interacting with attacker infrastructure. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage compromise or lateral movement attempts before they escalate into a full breach.

IOC Summary

Threat: wraith Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: wraith
let malicious_domains = dynamic(["94.154.43.192"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.192"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Phishing Simulation or Security Awareness Training: Security teams often use URLhaus data or similar threat intelligence feeds to populate realistic lures in phishing simulations (e.g., using GoPhish or KnowBe4). If a user clicks a link that resolves to a known Wraith-associated domain as part of a training exercise, the detection may fire.

  • Filter/Exclusion: Exclude alerts where the source user is part of the “Security Team” or “Phishing Simulation” AD group, or where the destination URL contains a known simulation path (e.g., /training/, /sim/).

• Web Application Testing with Known Vulnerable Endpoints: Developers or QA engineers may intentionally browse to or test against legacy or vulnerable endpoints that have been cataloged in threat intelligence databases like URLhaus. For instance, testing a deprecated API endpoint that was previously compromised by Wraith malware.

  • Filter/Exclusion: Exclude alerts originating from specific developer subnets (e.g., 10.20.0.0/24) or from accounts tagged with the “DevOps” or “QA” role, particularly if the HTTP method is GET and the response code is 200 or 404 (indicating a test rather than an execution).

• Browser Extension or Content Blocker Caching: Some advanced browser extensions (e.g., uBlock Origin, AdGuard) or corporate proxy caches may fetch or validate URLhaus entries to update their blocklists. This can result in a legitimate service account or a user’s browser making a request to a Wraith-tagged URL for validation purposes.

  • Filter/Exclusion: Exclude alerts where the source process is a known browser extension host (e.g., chrome.exe with a specific extension ID) or where the user agent string contains “uBlock”, “AdGuard”, or “Proxy