URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the consumption of newly identified malicious web resources flagged by URLhaus under signature 54e64e, which often indicate early-stage phishing or command-and-control activities. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before these emerging threats are widely adopted by automated defense systems.

IOC Summary

Threat: 54e64e Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: 54e64e Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Security Tool Updates and Threat Intelligence Feeds

  • Context: Enterprise security tools such as CrowdStrike Falcon, SentinelOne, or Tenable Nessus frequently query the URLhaus API (or similar threat intelligence feeds) to update their local databases. These queries often hit URLs that are flagged in real-time by URLhaus but represent known, benign infrastructure used for updates rather than active malware propagation.
  • Suggested Filter/Exclusion: Create a rule exception based on the source host or process name. Exclude traffic originating from specific security appliance FQDNs (e.g., *.crowdstrike.com, *.sentinelone.net) and processes like falcon.sys or SentinelOneAgent.exe. Additionally, filter out HTTP GET requests where the User-Agent string contains keywords like “CrowdStrike,” “Tenable,” or “URLhaus-Client.”

• Scenario: Scheduled Microsoft Office 365 Compliance and Reporting Jobs

  • Context: Scheduled PowerShell scripts running via Task Scheduler often trigger compliance checks, data loss prevention (DLP) scans, or report generation for Microsoft 365. These jobs may fetch external resources or validate URLs against a threat intelligence service that coincidentally matches the 54e64e signature pattern. The traffic is administrative in nature and not user-initiated browsing.
  • Suggested Filter/Exclusion: Implement an exclusion based on the initiating process and scheduled time window. Exclude events where the process name is powershell.exe or msedge.exe (running as a service account) during off-