URLhaus: ascii Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the consumption of newly identified ASCII-formatted malicious URLs from the URLhaus threat intelligence feed, which often signal early-stage phishing or command-and-control communications. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before these high-severity threats propagate across the organization’s network.

IOC Summary

Threat: ascii Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["api.recapcha.space", "bore.pub"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["api.recapcha.space", "bore.pub"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: ascii Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanning by Endpoint Protection Agents

  • Context: Enterprise EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform background telemetry checks and signature updates. These agents often query the https://urlhaus-api.securelist.ru or similar threat intelligence endpoints to fetch ASCII-based URL signatures, which can be flagged as “malicious” due to their high-entropy nature or specific API response patterns.
  • Suggested Filter/Exclusion: Create a rule exclusion based on the Source Host ID or Process Name. Exclude traffic originating from processes named C-Snap.exe (CrowdStrike) or MsMpEng.exe (Microsoft Defender) when accessing known threat intelligence domains.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often generate temporary ASCII URLs during the creation of backup logs, metadata synchronization, or report generation tasks. These jobs run via scheduled tasks (e.g., Task Scheduler on Windows Server) and may trigger HTTP requests to internal reporting dashboards that contain long, complex URL strings tagged as “ascii” by the detection engine.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window or a destination IP filter. Exclude traffic from backup service accounts (e.g., svc_veeam or svc_commvault) accessing internal reporting subnets during defined maintenance windows (e.g., 02:00 – 04:00 local time).

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps platforms like Jenkins, **