URLhaus: 64-bit Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging 64-bit specific malicious URLs to execute payloads or establish command-and-control channels, often indicating a targeted attack against modern x64 architectures. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints early by correlating URL traffic with host telemetry, reducing the dwell time of threats that exploit architecture-specific vulnerabilities.

IOC Summary

Threat: 64-bit Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 64-bit
let malicious_domains = dynamic(["176.65.134.121"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.134.121"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to fetch a specific build artifact or dependency from a staging repository that shares the same domain structure as the malicious URL, triggering the rule during automated deployment tasks.

  • Filter/Exclusion: Exclude network connections where the source process is a known build agent (e.g., java.exe, node.exe, python.exe in a CI context) or filter by the specific user account associated with the CI/CD service (e.g., svc-cicd or github-actions).

• Scenario: An IT administrator runs a scheduled PowerShell script to update internal documentation or sync configuration files from a shared network drive or internal web service that happens to use a URL path matching the malicious signature (e.g., /64bit/ or similar generic paths).

  • Filter/Exclusion: Exclude events where the source process is powershell.exe or pwsh.exe and the connection is to an internal IP range (e.g., 10.x.x.x or 192.168.x.x), or specifically exclude the scheduled task name (e.g., DailyDocSync) if the rule can correlate with process command lines.

• Scenario: A security team or developer is actively testing the detection rule in a non-production environment or using a test client (like curl or wget) to verify URL accessibility, inadvertently triggering the alert during a planned maintenance window.

  • Filter/Exclusion: Exclude connections originating from known test or staging server IP ranges (e.g., 172.16.0.0/16) or filter out events where the source process is curl.exe, wget.exe, or powershell.exe with a command line containing test-related keywords (e.g., -test,