URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activities involving known malicious ASCII-formatted URLs that may indicate command-and-control communications or phishing attempts targeting user endpoints. Proactively hunting for these specific URL patterns in Azure Sentinel is critical to rapidly isolate compromised assets and prevent lateral movement before attackers can establish a persistent foothold within the network.

IOC Summary

Threat: ascii Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["drive.google.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drive.google.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ascii Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Automated Patch Management Scans

  • Scenario: Enterprise patch management tools like Microsoft Endpoint Configuration Manager (MECM) or Ivanti Neurons frequently query the URLhaus API to check the reputation of software update URLs before deployment. These queries often return a high volume of “ascii” tagged results as part of their baseline health checks, triggering alerts even when no actual threat is present on the endpoint.
  • Filter/Exclusion: Create an exclusion rule based on the Source Hostname or Process Name. Exclude traffic originating from System Center Configuration Manager (process: WmiPrvSE.exe) or specific patch management service accounts where the destination URL contains known update repository domains (e.g., *.microsoft.com, *.softwareupdate.apple.com).

• Scheduled Backup and Archive Jobs

  • Scenario: Automated backup solutions such as Veeam Backup & Replication or Commvault run nightly jobs that validate the integrity of stored artifacts by fetching metadata from cloud storage providers. These jobs often generate HTTP requests to URLs tagged with “ascii” encoding for manifest files, which the detection logic interprets as potential malicious activity due to the high frequency of these scheduled tasks during off-hours.
  • Filter/Exclusion: Implement a time-based filter combined with process whitelisting. Exclude alerts generated by processes Veeam.Backup.Service.exe or commvault.cmd occurring between 02:00 and 06:00 local time, provided the destination URL belongs to known cloud storage providers (e.g., AWS S3, Azure Blob) rather than external public web domains.

• Internal Documentation and Knowledge Base Crawling