URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving specific malicious URLs flagged by URLhaus with the tag d52f85, which often indicate active phishing campaigns or command-and-control infrastructure used in malware distribution. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: d52f85 Malicious URLs detection rule, including suggested filters and exclusions:

• Scenario: Automated Security Scanner Traffic

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to check for known malicious signatures. These tools often query the URLhaus API directly, generating traffic that matches the d52f85 signature logic while performing routine health checks.
  • Filter/Exclusion: Exclude network traffic originating from the IP address ranges of the security scanner appliances or specific service accounts (e.g., scanner-service-account) where the destination is the URLhaus API endpoint (api.urlhaus.io).

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup solutions like Veeam, Commvault, or Rubrik frequently initiate connections to cloud storage gateways. If these gateways utilize a shared CDN or proxy that is flagged by URLhaus as part of the d52f85 cluster, the scheduled nightly backup jobs will trigger the rule despite being benign operations.
  • Filter/Exclusion: Create an exclusion based on the specific process name (e.g., VeeamBackupService.exe, commvault_agent) and restrict the alert to only fire during non-business hours if the job is known to run at 02:00 AM, or simply whitelist the destination FQDNs used by the backup gateway.

• Scenario: Software Update Mechanisms

  • Context: Enterprise endpoint management tools such as Microsoft Intune, Jamf Pro, or WSUS (Windows Server Update Services) regularly contact update servers to download patches and metadata. These update servers often host content that overlaps