URLhaus: ascii Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging ASCII-encoded malicious URLs to obfuscate phishing links or command-and-control channels, a technique that often bypasses basic signature-based detection. Proactively hunting for these specific URL patterns in Azure Sentinel allows the SOC to identify compromised endpoints or email gateways before the encoded payloads are decoded and executed, reducing the mean time to detection for high-severity web-based threats.

IOC Summary

Threat: ascii Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["hponline.run.place"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["hponline.run.place"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., an old ASP.NET or PHP-based inventory system) performs automated health checks or “ping” requests to a known endpoint that is currently listed on URLhaus due to a recent compromise or shared infrastructure.
  • Filter/Exclusion: Exclude source IPs belonging to the specific legacy application server cluster (e.g., 10.20.5.10-10.20.5.15) or exclude the specific user-agent string used by the health check script (e.g., LegacyApp-HealthCheck/1.0).
• CI/CD Pipeline Dependency Fetching: A Jenkins or GitLab CI pipeline job downloads a specific library or configuration file from a public repository or CDN that has been temporarily flagged by URLhaus due to a supply chain issue or misconfiguration, but the artifact itself is verified via checksum.
  • Filter/Exclusion: Exclude traffic originating from the CI/CD runner nodes (e.g., ci-runner-pool) where the destination URL matches the specific flagged path but the source process is java or node and the request includes a Authorization: Bearer <token> header.
• Scheduled Backup Verification: A scheduled cron job or Windows Task Scheduler task runs a verification script that queries a remote backup storage endpoint (e.g., S3, Azure Blob, or a private SFTP server) to confirm backup integrity. The endpoint URL is on the list because it is shared across multiple tenants or was recently compromised.
  • Filter/Exclusion: Exclude traffic where the source process is python or bash and the destination port is 443, with the URL path containing /backup/verify or /health, and the source host is in the backup-services subnet.
• Third-Party API Integration: