URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This rule identifies potential compromise by detecting traffic to five known malicious URLs associated with the d52f85 campaign, which adversaries may use for command-and-control or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify affected hosts early, preventing lateral movement or data exfiltration before the threat actor establishes a persistent foothold in the environment.

IOC Summary

Threat: d52f85 Total URLs: 5 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) uses a hardcoded health check endpoint that points to a known test server or CDN edge node which has been recently tagged by URLhaus. This occurs because the application’s ping or heartbeat mechanism is configured to verify connectivity to a specific IP/URL that overlaps with the malicious list.

  • Filter/Exclusion: Exclude source processes named java.exe or dotnet.exe where the destination URL matches the specific d52f85 list entries, provided the source port is a standard HTTP/HTTPS port (80/443) and the user context is a service account (e.g., svc_app_health).

• Browser Extension Auto-Update: A widely deployed enterprise browser extension (e.g., a custom SSO helper or security scanner) performs an automatic update check by fetching a manifest file from a public CDN. If the CDN’s origin server or a specific subdomain is temporarily flagged by URLhaus due to a shared infrastructure compromise, all endpoints with the extension installed will trigger the rule.

  • Filter/Exclusion: Exclude events where the initiating process is chrome.exe, edge.exe, or firefox.exe and the URL path contains /update/, /manifest.json, or /latest/, specifically for the known extension IDs or publisher domains associated with the enterprise IT stack.

• Scheduled Log Rotation and Archiving: A scheduled task (e.g., LogArchiver_v2) runs daily to compress and upload old log files to a shared network drive or an internal object storage bucket. If the internal storage endpoint’s DNS record resolves to an IP address that is part of the d52f85 malicious cluster (due to a shared hosting provider or misconfigured reverse proxy), the outbound connection will match the rule.