URLhaus: base64 Malicious URLs

Hunt Hypothesis

Adversaries may be using base64-encoded URLs to obfuscate malicious payloads and evade basic detection mechanisms. Proactively hunting for these URLs in Azure Sentinel can help identify potential command and control channels or data exfiltration attempts early in the attack lifecycle.

IOC Summary

Threat: base64 Total URLs: 15 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: base64
let malicious_domains = dynamic(["firebasestorage.googleapis.com", "91.92.42.46", "gitlab.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["firebasestorage.googleapis.com", "91.92.42.46", "gitlab.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Scheduled Job for URL Encoding Testing
  Description: A system administrator runs a scheduled job to test URL encoding/decoding functionality for internal tools, which generates base64 strings that resemble malicious URLs.
  Filter/Exclusion: Exclude URLs containing the string test_encode or url-encoder in the request path or query parameters.

• Scenario: CI/CD Pipeline Artifact Download
  Description: A CI/CD pipeline downloads artifacts from a private registry using base64-encoded URLs for secure transmission, which may trigger the rule.
  Filter/Exclusion: Exclude URLs that match the CI/CD server domain (e.g., ci.example.com) or contain artifact in the path.

• Scenario: Admin Task for Base64 Decoding in Logs
  Description: A security analyst manually decodes base64 strings in log files to investigate potential encoding-based attacks, which may be flagged as malicious URLs.
  Filter/Exclusion: Exclude URLs that contain the string base64decode or decode in the query parameters or user agent.

• Scenario: Internal Tool for URL Shortening
  Description: An internal URL shortening tool uses base64 encoding to generate short links, which may be misinterpreted as malicious URLs by the detection rule.
  Filter/Exclusion: Exclude URLs that originate from the internal shortening service (e.g., short.example.com) or contain shorten in the request path.

• Scenario: Legacy System Base64 Encoding for Data Transfer
  Description: An outdated system uses base64 encoding to transfer data between components, generating URLs that look like malicious base64 strings.
  Filter/Exclusion: Exclude URLs that match the legacy system’s internal API endpoint (e.g., legacy-api.example.com) or contain data-transfer in the