URLhaus: 9d2ca3 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving specific malicious URLs tagged as 9d2ca3 from URLhaus, which often indicate active phishing campaigns or command-and-control communications. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 9d2ca3 Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 9d2ca3
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 9d2ca3 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanner Crawls

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically crawl external endpoints to verify certificate validity and reachability. These tools often generate high volumes of HTTP/HTTPS requests to known public URLs that may be flagged by URLhaus due to recent reputation changes or shared hosting environments, even if the specific scanned resource is safe.
  • Filter/Exclusion: Create a rule exclusion based on the Source Hostname or User-Agent string matching the scanner’s signature (e.g., exclude traffic where user_agent contains “Tenable” or “Qualys”). Alternatively, whitelist the IP ranges of the internal scanning appliances.

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync tools (Microsoft OneDrive for Business, Dropbox) execute scheduled jobs to fetch metadata, update manifests, or verify connectivity with upstream storage endpoints. These background processes often connect to generic CDN URLs or API gateways that might be tagged as “9d2ca3” due to shared infrastructure usage by other entities.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts (e.g., svc-backup-agent) or filter based on the destination domain if it matches known backup provider domains (e.g., *.veeam.com, *.onedrive.live).

• Scenario: Patch Management and Software Update Agents

  • Context: System update agents such as Microsoft Endpoint Configuration Manager (MECM/SCCM), Jamf,