URLhaus: hta Malicious URLs

Hunt Hypothesis

Adversaries may be using malicious HTA files hosted on compromised or command-and-control servers to execute payloads and establish persistence. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise of endpoints and exfiltration of sensitive data.

IOC Summary

Threat: hta Total URLs: 13 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: hta
let malicious_domains = dynamic(["172.245.209.253", "107.172.135.8"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["172.245.209.253", "107.172.135.8"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Scheduled System Update Job
  Description: A legitimate scheduled job runs a Windows Update or patching tool that downloads an HTA file as part of the update process.
  Filter/Exclusion: Exclude URLs containing windowsupdate.com, update.microsoft.com, or patchingtool.exe in the request path.

• Scenario: Admin Task - HTA-based Reporting Tool
  Description: An enterprise admin uses a custom HTA-based reporting tool to generate system health reports, which includes a legitimate HTA file hosted internally.
  Filter/Exclusion: Exclude URLs from internal IP ranges (e.g., 10.0.0.0/8) or domains like internal.reporting.tools.

• Scenario: Malware Analysis Lab Environment
  Description: A security team is testing a malicious HTA file in a sandboxed environment, which triggers the rule due to the HTA file being hosted on a test server.
  Filter/Exclusion: Exclude URLs containing sandbox, malwarelab, or test.hta in the file path.

• Scenario: PowerShell Script with HTA Output
  Description: A PowerShell script generates an HTA file for user interaction (e.g., for a GUI-based script interface), which is then hosted temporarily on an internal server.
  Filter/Exclusion: Exclude URLs containing powershell.hta, script-output.hta, or from internal DNS names like scriptserver.local.

• Scenario: Third-Party Software Installer
  Description: A legitimate third-party software installer uses an HTA file for user consent or configuration, and the installer is hosted on a trusted CDN.
  Filter/Exclusion: Exclude URLs containing softwareinstaller.hta, trustedcdn.com, or installer.hta in the file path.