URLhaus: 9d2ca3 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving the consumption of known malicious web resources identified by URLhaus signature 9d2ca3, which often indicates initial phishing or drive-by download attacks. Proactively hunting for these specific URLs in Azure Sentinel is critical to rapidly identify compromised endpoints and block lateral movement before attackers can establish persistence within the network.

IOC Summary

Threat: 9d2ca3 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 9d2ca3
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 9d2ca3 Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Software Update Scanners

  • Scenario: Enterprise patch management tools (e.g., Microsoft SCCM, Ivanti Endpoint Manager, or Jamf) frequently query external repositories to check for the latest security definitions. These agents often pull metadata from URLs that share IP ranges with known malicious domains due to shared hosting infrastructure, triggering the 9d2ca3 tag even though the traffic is benign update checks.
  • Suggested Filter: Create an exclusion based on the Source Process Name (e.g., ccmexec.exe, JamfProAgent.exe) combined with a whitelist of specific Destination Hostnames known to be part of the vendor’s legitimate update infrastructure.

• Scheduled Cloud Backup and Sync Jobs

  • Scenario: Scheduled backup tasks running via tools like Veeam, Rubrik, or Microsoft OneDrive for Business initiate connections to cloud storage endpoints during off-hours (e.g., 2:00 AM – 4:00 AM). If the backup service uses a Content Delivery Network (CDN) that has recently hosted malicious content, the initial handshake URL may be flagged as 9d2ca3 despite the data transfer being secure and authorized.
  • Suggested Filter: Exclude traffic originating from specific Service Accounts (e.g., svc-backup-agent) during defined maintenance windows, or filter by User Agent strings unique to these backup applications (e.g., containing “VeeamAgent” or “OneDriveSync”).

• IT Admin Manual Research and Troubleshooting

  • Scenario: Security analysts and system administrators manually investigate threats using web-based