URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving the execution or access of two specific malicious URLs flagged by URLhaus with the identifier d52f85, which often indicate active phishing campaigns or command-and-control communications. SOC teams should proactively hunt for these indicators within Azure Sentinel to rapidly isolate affected endpoints and prevent potential lateral movement or data exfiltration before the threat escalates across the network.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: d52f85 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Tool Updates

  • Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Trend Micro Apex One frequently initiate background updates by fetching configuration manifests and definition databases from their cloud repositories. These URLs often contain dynamic query parameters that match the d52f85 signature pattern but are benign.
  • Suggested Filter: Exclude traffic originating from known internal update service accounts (e.g., svc-crowdstrike-updater) or specific hostnames ending in .update.microsoft.com, *.crowdstrike.com, and *.trendmicro.com.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Daily scheduled jobs using tools like Veeam Backup & Replication, Rubrik, or Commvault often connect to external S3 buckets (e.g., AWS, Azure Blob) or cloud storage APIs to verify integrity hashes. The URLs generated during these handshakes can be flagged as malicious due to the presence of hash strings in the query path that resemble the d52f85 tag.
  • Suggested Filter: Create an exclusion rule for traffic initiated by backup service accounts (e.g., svc-veeam-agent) connecting to known cloud storage domains such as *.s3.amazonaws.com, *.blob.core.windows.net, or specific IP ranges associated with the enterprise’s primary cloud provider.

• Scenario: Third-Party SaaS Integration Webhooks

  • Context: Business applications like Salesforce, ServiceNow, or Workday utilize webhooks to push real-time data events to external partners or internal analytics dashboards (e.g