URLhaus: ascii Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging ASCII-tagged malicious URLs identified by URLhaus to deliver phishing payloads or command-and-control traffic within the organization’s network. Proactively hunting for these specific indicators in Azure Sentinel is critical because their high severity suggests an active threat landscape where early detection of these known malicious endpoints can prevent lateral movement and data exfiltration before automated rules trigger alerts.

IOC Summary

Threat: ascii Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ascii
let malicious_domains = dynamic(["dragonsurcing.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["dragonsurcing.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ascii Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently perform background checks against known threat intelligence feeds. These agents often query URLhaus directly to validate the reputation of newly installed software binaries, generating legitimate traffic that mimics malicious URL patterns due to the high volume of “ascii” tagged checks during peak update windows (e.g., 2:00 AM – 4:00 AM).
  • Filter/Exclusion: Create an exclusion rule based on the Source Host or Process Name. Filter out traffic originating from specific service accounts (e.g., svc-crowdstrike, sentinelone-agent) or processes running as System during scheduled maintenance windows.

• IT Administration and Patch Management Workflows

  • Scenario: System administrators using tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager execute scheduled jobs to deploy patches and verify software integrity. These workflows often trigger HTTP/HTTPS requests to URLhaus to cross-reference the signatures of patch files against the “ascii” malicious category before pushing updates to the production fleet, resulting in legitimate hits on the detection rule.
  • Filter/Exclusion: Implement a filter based on User Identity or Source IP Range. Exclude traffic from the dedicated IT Management subnet (e.g., 10.20.30.0/24) and specific service accounts used by patch management tools (e.g., svc-sccm-admin, ivanti-service).

• **Third-Party Security Information and Event Management (SIEM) En