URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This hunt targets potential web-based initial access or payload delivery by identifying traffic to three known malicious URLs associated with the d52f85 tag. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect compromised endpoints or phishing campaigns early, mitigating the risk of further lateral movement or data exfiltration before the adversary establishes a persistent foothold.

IOC Summary

Threat: d52f85 Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["github.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["github.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: An older internal web application (e.g., a custom Java-based inventory system) uses a hardcoded health check endpoint that points to a known public test server or a specific URLhaus-tracked domain for latency monitoring. This is not malicious but is a configuration artifact.
  • Filter/Exclusion: Exclude the specific service account or computer name associated with the legacy app (e.g., AppHealthChecker_SVC) from the URLhaus detection if the URL matches the known health check pattern.
• Browser Extension Telemetry: A widely used enterprise browser extension (e.g., a password manager or ad-blocker) sends periodic telemetry or update checks to a domain that has been recently flagged by URLhaus due to a compromise of its upstream CDN or a specific subdomain, even though the extension itself is signed and trusted.
  • Filter/Exclusion: Exclude processes known to be browser executables (e.g., chrome.exe, edge.exe, firefox.exe) when the parent process is a recognized browser and the URL matches the specific d52f85 tag, provided the browser version is up-to-date.
• Scheduled Maintenance Scripts: A PowerShell or Bash script executed by a scheduled task (e.g., DailyLogCleanup) downloads a small configuration file or checksum from a public repository or CDN that happens to be hosted on a URLhaus-tracked domain for this specific tag. The script is signed and runs from a standard admin path.
  • Filter/Exclusion: Exclude the specific scheduled task name (e.g., DailyLogCleanup) or the script path (e.g., C:\Scripts\maintenance\cleanup.ps1) if the user context is a known service account and the URL matches the specific d52f85 entry.
• Development Sandbox Environments: Developers in a non-production sandbox environment (e