URLhaus: DPRK Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints communicate with known North Korean (DPRK) malicious infrastructure, indicating potential reconnaissance or command-and-control activity from state-sponsored threat actors. Proactively hunting for these specific URLs in Azure Sentinel is critical to identify early-stage DPRK campaigns and mitigate risks before they escalate into full-scale data exfiltration or lateral movement incidents.

IOC Summary

Threat: DPRK Total URLs: 5 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: DPRK
let malicious_domains = dynamic(["srv335762319.host.ultaserver.net", "46.183.25.232", "ezpz.link", "www.ezpz.link"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["srv335762319.host.ultaserver.net", "46.183.25.232", "ezpz.link", "www.ezpz.link"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: DPRK Malicious URLs rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Security Software Updates via Internal Proxy

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) are configured to download definition updates from a vendor’s regional mirror hosted on an IP range that shares infrastructure with DPRK-linked entities. During the nightly 2:00 AM maintenance window, thousands of agents simultaneously connect to these update servers, triggering the rule due to shared ASN or historical URL tagging.
  • Filter/Exclusion: Create an exclusion for traffic originating from the specific Endpoint Protection Service Accounts (e.g., svc-defender-update) connecting to known vendor IP ranges (e.g., *.crowdstrike.com, *.sentinelone.net). Additionally, filter out events occurring strictly between 01:30 and 03:30 UTC on weekdays.

• IT Admin Manual Research and Threat Intelligence Consumption

  • Scenario: Security analysts or IT administrators manually browse external threat intelligence platforms (e.g., Recorded Future, Mandiant, or CISA.gov) to investigate current geopolitical threats. These portals often embed content, maps, or data feeds hosted on subdomains that have been flagged by URLhaus as DPRK-associated due to shared hosting providers in the region, even though the primary domain is benign.
  • Filter/Exclusion: Exclude traffic generated by user groups designated as “Security_Ops” or “IT_Admin”. Implement a whitelist for specific high-trust domains (e.g., *.cisa.gov, *.recordedfuture.com) where the DPRK tag appears only on secondary resource links rather than the primary navigation.

• **Automated Compliance and