URLhaus: encrypted Malicious URLs

Hunt Hypothesis

The detection identifies potential adversary activity where encrypted URLs from URLhaus are being accessed, indicating possible delivery of malicious payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover covert command and control channels or data exfiltration attempts.

IOC Summary

Threat: encrypted Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: encrypted
let malicious_domains = dynamic(["bgmotors.ro", "cembusconfort.ro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["bgmotors.ro", "cembusconfort.ro"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is using curl or wget to download a signed package from a secure internal repository that contains encrypted URLs as part of a secure update mechanism.
  Filter/Exclusion: Exclude URLs that match internal repository domains or use curl/wget with --insecure or --no-check-certificate flags.

• Scenario: A scheduled job runs ansible to fetch encrypted URLs from a private artifact registry as part of a CI/CD pipeline for secure artifact distribution.
  Filter/Exclusion: Exclude URLs that match known CI/CD artifact registry domains or include ansible in the process name.

• Scenario: A security analyst is using mitmproxy to inspect encrypted HTTPS traffic and manually decrypts URLs for analysis, which are temporarily stored in a log file.
  Filter/Exclusion: Exclude log entries containing mitmproxy or any process related to traffic inspection tools.

• Scenario: A backup job uses rsync to transfer encrypted URLs from a staging environment to a production server as part of a data migration process.
  Filter/Exclusion: Exclude URLs that match staging environment domains or include rsync in the command line.

• Scenario: A DevOps team uses terraform to provision infrastructure and includes encrypted URLs in configuration files for secure resource access.
  Filter/Exclusion: Exclude URLs that match infrastructure-as-code repositories or include terraform in the process name.