URLhaus: ascii Malicious URLs

Hunt Hypothesis

This rule detects adversary activity involving the use of ASCII-encoded malicious URLs, a technique often employed to obfuscate command-and-control channels or exploit chains that bypass basic signature-based filters. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or data exfiltration attempts early, reducing the dwell time of threats that leverage simple encoding for stealth.

IOC Summary

Threat: ascii Total URLs: 13 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["216.9.224.48", "96.44.167.210", "epibenie.dz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["216.9.224.48", "96.44.167.210", "epibenie.dz"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a Java-based ERP system) uses a hardcoded health-check script that pings a specific, now-compromised staging URL to verify connectivity before deploying new features.
  • Filter/Exclusion: Exclude source IPs belonging to the App-Health-Check service account or specific application server subnets (e.g., 10.20.5.0/24) when the destination URL matches the known false-positive list.
• CI/CD Pipeline Dependency Fetching: A Jenkins or GitLab CI job downloads a specific open-source library or binary from a URL that has been recently tagged as malicious in URLhaus due to a compromised maintainer account, but the build pipeline has not yet been updated to use a mirror or checksum-verified source.
  • Filter/Exclusion: Correlate the alert with the Jenkins-Job-Name or GitLab-Pipeline-ID metadata; if the source is a known CI runner and the destination matches the specific URL, suppress the alert for 24 hours pending pipeline update.
• Scheduled Backup Verification: A nightly scheduled task (cron job or Windows Task Scheduler) runs a verification script that accesses a specific external S3 bucket or CDN endpoint to validate backup integrity; the endpoint’s domain was recently flagged in URLhaus due to a DNS hijack or certificate issue, but the connection remains secure via TLS pinning.
  • Filter/Exclusion: Exclude alerts where the source process is backup-verify.sh or BackupService.exe and the destination URL matches the specific flagged endpoint, provided the TLS handshake was successful and no subsequent data exfiltration was observed.
• Developer Local Testing: A developer on a corporate laptop uses a local proxy (e.g., Fiddler or Charles Proxy) to intercept traffic to a specific