URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This rule detects the presence of two specific malicious URLs from the URLhaus database, indicating potential web-based intrusion or phishing activity targeting your environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or network flows before they can be leveraged for lateral movement or data exfiltration.

IOC Summary

Threat: 54e64e Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a microservice where the build artifact or configuration file contains a hardcoded reference to a staging environment URL that happens to match the 54e64e hash due to a shared CDN or temporary asset hosting.

  • Filter/Exclusion: Exclude network connections initiated by service accounts associated with CI/CD runners (e.g., svc-ci-runner, jenkins-agent) or filter out traffic destined for known internal staging domains (e.g., *.staging.internal.corp) when the source process is a build tool like docker, kubectl, or git.

• Scenario: A security team performs a periodic vulnerability scan using tools like Nessus or Qualys, which probe external endpoints to verify reachability. The scanner may hit a known malicious URL listed in the URLhaus feed as part of a broad external asset discovery task, triggering the rule even though the connection is initiated by a controlled, authenticated scanner.

  • Filter/Exclusion: Exclude events where the source process is a known scanning tool (e.g., nessus.exe, qualys_agent.exe, nmap.exe) and the destination IP/URL matches the specific 54e64e entry, provided the source host is tagged in CMDB as a “Security Scanner” or “Vulnerability Management” asset.

• Scenario: An automated backup or sync job (e.g., Veeam, Rubrik, or Azure Backup) replicates data to a secondary cloud storage bucket. If the backup metadata or manifest file includes a reference to a previously archived malicious URL (e.g., from a compromised user profile backup), the sync process may generate a network event or file write event that correlates with the URLhaus signature.

  • Filter/Exclusion: Exclude events originating