URLhaus: encrypted Malicious URLs

Hunt Hypothesis

This hypothesis detects adversaries leveraging encrypted malicious URLs to bypass traditional inspection mechanisms and deliver payloads or redirect victims to phishing sites without triggering standard decryption alerts. A proactive hunt is essential in Azure Sentinel because encrypted traffic often obscures command-and-control communications, requiring specialized analysis of URLhaus intelligence feeds to identify high-severity threats that may otherwise remain invisible within the network perimeter.

IOC Summary

Threat: encrypted Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: encrypted
let malicious_domains = dynamic(["drive.google.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drive.google.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: encrypted Malicious URLs rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated SaaS Health Checks via Encrypted Probes

  • Context: Enterprise monitoring tools like Datadog, New Relic, or PagerDuty frequently initiate outbound HTTPS connections to external health check endpoints (e.g., api.statuspage.io, healthcheck.pagerduty.com) using encrypted tunnels. These URLs often contain dynamic query parameters that can resemble malicious signatures, triggering the rule when the URLhaus feed flags them as “new” or “suspicious.”
  • Filter/Exclusion: Create a whitelist exclusion for known SaaS health check domains and specific IP ranges used by monitoring agents. Additionally, add a filter to exclude URLs where the User-Agent string matches standard monitoring tool signatures (e.g., containing Datadog-APM, NewRelic).

• Scenario: Scheduled Cloud Backup Encryption Handshakes

  • Context: Automated backup solutions such as Veeam, Rubrik, or Azure Backup perform nightly scheduled jobs to establish encrypted connections with cloud storage gateways (e.g., AWS S3, Azure Blob). During the initial TLS handshake and metadata exchange, these systems generate unique, long-form encrypted URLs that may be misidentified by URLhaus as malicious due to their complexity and lack of historical reputation data.
  • Filter/Exclusion: Implement a time-based exclusion rule (e.g., exclude alerts between 02:00–04:00 UTC) for backup service accounts. Alternatively, filter out URLs containing specific backup protocol identifiers in the path (e.g., /backup/v1/sync) and match against the known source IP of the backup appliance.

• **Scenario: CI/