URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the specific malicious URL cluster d52f85 to establish initial access or exfiltrate data, often through phishing or compromised web assets. Proactively hunting for these URLs in Azure Sentinel allows the SOC to identify compromised endpoints or user sessions before the threat actor can execute further post-compromise actions or lateral movement.

IOC Summary

Threat: d52f85 Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["github.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["github.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security engineer is performing manual validation or regression testing of the URLhaus feed integration by opening one of the known malicious URLs (e.g., https://d52f85.example.com/payload) in a dedicated test browser or using curl to verify the HTTP response headers and content type.

  • Filter/Exclusion: Exclude alerts where the source user account belongs to the Security-Engineering or SOC-Validation group, or where the process is curl.exe or wget.exe initiated from a developer workstation.

• Scenario: An automated vulnerability scanner (such as Nessus or Qualys) is configured to probe internal or external endpoints for known CVEs and includes the d52f85 URL set in its custom scan policy to check for server-side response anomalies or redirect chains.

  • Filter/Exclusion: Exclude alerts where the source IP address is within the designated Scanner-Subnet (e.g., 10.20.50.0/24) or where the initiating process is nessus-agent.exe or qualys-agent.exe.

• Scenario: A DevOps engineer is debugging a broken CI/CD pipeline step that uses a generic HTTP client library to fetch metadata from a list of known bad URLs to test error handling logic (e.g., verifying that the app correctly returns a 404 or 500 status code for these specific d52f85 endpoints).

  • Filter/Exclusion: Exclude alerts where the source process is a build agent binary (e.g., jenkins-agent.jar, azure-pipelines-agent.exe, or gitlab-runner) and the command line arguments contain keywords like test, debug, or validate.

• Scenario: A web application firewall (WAF) or reverse proxy (e.g.,