URLhaus: 54e64e Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised hosts initiate outbound connections to known malicious infrastructure identified by URLhaus under the signature 54e64e. Proactively hunting for these specific URLs in Azure Sentinel is critical to rapidly identify early-stage command-and-control communications or phishing campaigns before they escalate into widespread data exfiltration events.

IOC Summary

Threat: 54e64e Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 54e64e
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 54e64e Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Telemetry & Updates

  • Scenario: The endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) automatically queries the URLhaus API to fetch the latest threat intelligence feeds and signature updates. These background processes often generate high-volume HTTP/HTTPS traffic to urlhaus.abuse.ch or related subdomains, which may be flagged as “malicious” if the specific hash 54e64e is associated with a known update server that hasn’t been whitelisted in the detection logic yet.
  • Suggested Filter: Exclude traffic originating from the specific service accounts used by the EDR agents (e.g., svc-crowdstrike-updater, LocalSystem) and restrict the rule to exclude destination ports 443/80 when the User-Agent string contains “CrowdStrike” or “Microsoft Defender”.

• Scheduled Software License Verification

  • Scenario: Enterprise-wide scheduled tasks (e.g., via Windows Task Scheduler or Ansible) trigger license validation checks for critical business applications like Adobe Creative Cloud, Microsoft Office 365, or specialized engineering tools (AutoCAD). These jobs periodically call external vendor endpoints to verify subscription status. If the vendor’s verification endpoint shares a certificate chain or IP reputation with the 54e64e tag, legitimate license renewal pings may trigger the alert during off-hours (e.g., 2:00 AM daily runs).
  • Suggested Filter: Create an exclusion based on the specific scheduled job name (e.g., Adobe CC License Check, MSO365-Auth-Ping) and limit the rule’s scope to exclude traffic occurring during