URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known malicious web resources identified by URLhaus signature 54e64e, which often indicate initial phishing campaigns or drive-by download attacks. Proactively hunting for these specific URLs in Azure Sentinel is critical to rapidly identify compromised endpoints and block lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 54e64e Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 54e64e Malicious URLs detection rule, tailored for an enterprise environment:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform background checks against known threat intelligence feeds. These agents may query specific URLhaus endpoints or mirror sites to validate their own signature databases, triggering the 54e64e tag even though no actual user browsing activity occurred.
  • Filter/Exclusion: Exclude traffic originating from the internal IP ranges of the Endpoint Management Servers (e.g., 10.20.30.x) or filter by process name where the executable is a known security agent (e.g., C:\Program Files\CrowdStrike\fsagent.exe or MsMpEng.exe).

• Scheduled Compliance and Vulnerability Scanning Jobs

  • Scenario: Weekly scheduled vulnerability scans performed by tools like Tenable Nessus or Qualys often include a “Web Application” module that probes external threat intelligence URLs to verify certificate validity and content freshness. These scanners systematically hit the specific malicious URL list as part of their baseline health check, generating alerts for every scan cycle.
  • Filter/Exclusion: Create an exclusion rule based on the source IP addresses of the vulnerability scanning appliances (e.g., 192.168.50.10-15) and restrict the alert trigger to business hours only if the scans are manually triggered, or add a specific tag for “Scheduled Maintenance” in the SIEM workflow.

• IT Administration: Patch Management and Repository Sync

  • Scenario: During monthly patch cycles, IT administrators use tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible to synchronize