URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the specific malicious URLs identified in the URLhaus d52f85 tag to establish initial footholds or exfiltrate data via web traffic. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or anomalous network flows before the malicious URLs are rotated or blocked, ensuring rapid containment of high-severity threats.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A custom internal web application (e.g., a legacy Java-based inventory system) uses a hardcoded health-check endpoint that points to a staging or test environment URL which happens to match the d52f85 hash due to a shared infrastructure pattern or a known benign CDN used for asset delivery.

  • Filter/Exclusion: Exclude source processes named java.exe or dotnet.exe when the destination URL matches the specific hash d52f85 and the source IP is within the internal application server subnet (e.g., 10.20.0.0/24).

• Scheduled Backup Verification Jobs: A nightly scheduled task (e.g., BackupVerify.ps1 or a cron job) runs a PowerShell script that pings a remote storage gateway or verification endpoint to confirm backup integrity. If the gateway’s public-facing URL is registered in the URLhaus database under the d52f85 tag (perhaps due to a recent takedown or re-tagging), the script’s HTTP request triggers the alert.

  • Filter/Exclusion: Exclude alerts where the source process is powershell.exe or pwsh.exe and the command line contains -ExecutionPolicy Bypass or specific backup-related arguments (e.g., Verify-Backup), provided the destination URL matches the d52f85 hash.

• Third-Party SaaS Integration Webhooks: A marketing automation tool (e.g., HubSpot or Marketo) or a CI/CD pipeline (e.g., Jenkins or Azure DevOps) sends webhook notifications to a third-party service. If the receiving endpoint’s domain is associated with the d52f85 tag in URLhaus (possibly due to a shared hosting provider or a recently compromised but since-fixed domain), the outbound HTTP request generates a false