URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving two specific malicious URLs flagged by URLhaus under the d52f85 signature, which often indicate active phishing campaigns or command-and-control communications. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish a persistent foothold in the network.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: d52f85 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically contact the URLhaus API to fetch threat intelligence updates. The agent’s background process (FalconService.exe or MsMpEng.exe) initiates an HTTP/HTTPS request to a known URLhaus endpoint that may be flagged by the rule if the specific query string contains dynamic parameters resembling malicious patterns.
  • Suggested Filter: Exclude traffic where the source process name matches known EDR service executables (e.g., FalconService.exe, MsMpEng.exe) AND the destination domain is strictly within the urlhaus.abusix.com or api.urlhaus.org namespace.

• Scenario: Scheduled Backup and Reporting Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or reporting tools such as Splunk Universal Forwarder often run scheduled jobs (e.g., every morning at 02:00 AM) to push logs or fetch configuration manifests from external repositories. These jobs may query a URL that has been recently updated by the vendor and temporarily tagged with the d52f85 signature due to a new sub-path structure, triggering the rule despite being benign.
  • Suggested Filter: Create an exclusion for traffic originating from specific backup servers (identified by hostname or IP range) during defined maintenance windows (e.g., 01:00–04:00 local time), provided the destination URL ends with known vendor domains like veeam.com or splunk.com.

• **Scenario: Cloud