URLhaus: encrypted Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging newly reported malicious URLs that utilize encryption to evade traditional signature-based scanning and obscure command-and-control traffic. Proactive hunting for these encrypted threats within Azure Sentinel is critical to uncover stealthy initial access or data exfiltration attempts before they compromise sensitive assets.

IOC Summary

Threat: encrypted Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: encrypted
let malicious_domains = dynamic(["drive.google.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drive.google.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: encrypted Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Cloud Backup & Sync Operations

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft OneDrive/SharePoint frequently establish persistent HTTPS connections to cloud storage endpoints (e.g., *.blob.core.windows.net or *.sharepoint.com) to upload large encrypted data streams. These high-volume, long-duration encrypted sessions often mimic the traffic patterns of malicious command-and-control (C2) channels flagged by URLhaus.
  • Filter/Exclusion: Create a whitelist exclusion based on Destination IP ranges and Service Accounts. Specifically, exclude traffic originating from backup service accounts (e.g., svc-backup-01) destined for known cloud provider CIDR blocks (e.g., Microsoft Azure or AWS public IPs) where the SSL certificate is issued by trusted enterprise CAs.

• Scenario: Scheduled Software Update Mechanisms

  • Context: Endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs (typically early morning or off-hours) to fetch update manifests and download payloads over encrypted channels (https://*.update.microsoft.com or https://api.crowdstrike.com). These connections often involve new, dynamically generated URLs that may not yet be indexed in the URLhaus reputation database, triggering a “new/unknown” alert.
  • Filter/Exclusion: Implement a time-based filter combined with Process Name exclusion. Exclude alerts where the initiating process is FalconSensor.exe, SentinelOneAgent.exe, or MsMpEng.exe and the connection occurs during defined maintenance windows (e.g., 02:00–04:0