URLhaus: DPRK Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity where North Korean (DPRK) threat actors leverage malicious URLs to infiltrate networks and exfiltrate sensitive data. A SOC team should proactively hunt for these indicators in Azure Sentinel because DPRK campaigns often employ sophisticated, low-volume web-based attacks that require immediate identification to prevent potential data loss before broader compromise occurs.

IOC Summary

Threat: DPRK Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: DPRK
let malicious_domains = dynamic(["166.88.134.62"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["166.88.134.62"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: DPRK Malicious URLs detection rule, including suggested filters or exclusions tailored for an enterprise environment:

• Scenario: Automated Threat Intelligence Feed Updates

  • Context: Security Information and Event Management (SIEM) platforms like Splunk or Microsoft Sentinel, along with endpoint protection suites such as CrowdStrike Falcon or Trend Micro Apex One, frequently poll external threat intelligence feeds. These tools often query the URLhaus API directly to ingest the latest DPRK malware indicators, generating legitimate traffic that matches the rule’s signature.
  • Filter/Exclusion: Create a network-level exclusion for traffic originating from specific internal management subnets (e.g., 10.20.50.0/24) or whitelist the source IP addresses of known threat intelligence collectors. Alternatively, filter logs where the HTTP User-Agent string contains keywords like “CrowdStrike,” “Trend Micro,” or “Splunk-HTTP.”

• Scenario: Scheduled Backup and Cloud Synchronization Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or cloud sync tools like Microsoft OneDrive for Business often utilize external storage gateways. If the organization’s backup gateway or a specific cloud region shares an IP range with known DPRK infrastructure, scheduled nightly jobs (e.g., running at 02:00 AM) may trigger alerts when connecting to these endpoints for data exfiltration verification.
  • Filter/Exclusion: Implement a time-based exclusion window for the rule during peak backup hours (e.g., 01:00–04:00 local time). Additionally, exclude traffic where the destination port is standard backup ports (e.g., 8527 for Veeam) and the source process name matches known backup agents