URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious web resources flagged by URLhaus under the specific threat signature 54e64e. A SOC team should proactively search for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent potential data exfiltration or lateral movement before broader infection occurs.

IOC Summary

Threat: 54e64e Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 54e64e Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Security Tools

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external resources to check for known threats. These tools often query the URLhaus API directly or fetch threat feeds that include the 54e64e signature, triggering a hit even though the traffic is part of a scheduled maintenance job rather than user-initiated browsing.
  • Suggested Filter: Exclude network traffic where the source IP belongs to the dedicated “Security Scanners” subnet (e.g., 10.20.50.x) or filter by process name matching nessus.exe, qualyspc.exe, or rapid7-agent.

• Scenario: Scheduled Endpoint Protection Cloud Updates

  • Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black, perform daily cloud-based definition updates. During these scheduled jobs, the agent contacts threat intelligence hubs that may reference the 54e64e URL signature to validate local definitions, generating a false alert on the outbound connection.
  • Suggested Filter: Create an exclusion for traffic initiated by specific service processes (e.g., C:\Program Files\CrowdStrike\fs_qrte.exe or MsMpEng.exe) occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Third-Party Cloud Backup and Synchronization Services

  • Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync