URLhaus: honeypot Malicious URLs

Hunt Hypothesis

This rule detects potential compromise or reconnaissance activity by identifying traffic to known malicious URLs that have been tagged as honeypots, indicating an adversary is actively engaging with or scanning these decoy assets. Proactively hunting for these interactions in Azure Sentinel allows the SOC team to identify early-stage threats or lateral movement attempts before they escalate into a full breach.

IOC Summary

Threat: honeypot Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: honeypot
let malicious_domains = dynamic(["176.65.139.158"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.158"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Automated Vulnerability Scanning and Penetration Testing

  • Scenario: Security teams use tools like Nessus, Qualys, or Metasploit to perform routine vulnerability scans or penetration tests against internal assets. These tools often probe known honeypot IPs or URLs to verify network segmentation, firewall rules, or to test IDS/IPS detection capabilities.
  • Filter/Exclusion: Exclude source IPs belonging to the Security Operations Center (SOC) or Penetration Testing subnets (e.g., 10.20.50.0/24). Additionally, exclude user agents or source ports associated with scanning tools (e.g., nessus, qualys, metasploit) if the detection rule inspects metadata.

• Web Application Firewall (WAF) and Load Balancer Health Checks

  • Scenario: Enterprise load balancers (e.g., F5 BIG-IP, AWS ALB, Kubernetes Ingress Controllers) or WAFs (e.g., ModSecurity, AWS WAF) may perform active health checks or synthetic monitoring against backend services. If a honeypot URL is inadvertently included in a monitoring script or if a health check endpoint is misconfigured to point to a known honeypot IP for testing, legitimate traffic will trigger the alert.
  • Filter/Exclusion: Exclude traffic from Load Balancer or Monitoring service accounts (e.g., svc-healthcheck, svc-monitoring). Filter out requests where the User-Agent contains kube-probe, healthcheck, or synthetic-monitor.

• CI/CD Pipeline Dependency Scanning and Artifact Verification

  • Scenario: Continuous Integration/Continuous Deployment (CI/CD) systems like Jenkins, GitLab CI, or **Azure DevOps