URLhaus: d52f85 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised endpoints initiate connections to known malicious web resources identified by URLhaus under the d52f85 threat signature. Proactively hunting for these specific URLs in Azure Sentinel is critical because early detection of this high-severity indicator can prevent lateral movement and data exfiltration before automated rules trigger a full incident response.

IOC Summary

Threat: d52f85 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: d52f85
let malicious_domains = dynamic(["62.60.226.140"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.140"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: d52f85 Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Update Scanners (e.g., SCCM/MECM or Intune)

  • Scenario: Enterprise endpoint management tools frequently scan and download update manifests from third-party software vendors. If a vendor’s CDN node is recently flagged by URLhaus as d52f85 due to a transient issue, the mass deployment of updates across hundreds of workstations will trigger this rule repeatedly during scheduled maintenance windows (e.g., every Tuesday at 03:00 UTC).
  • Filter/Exclusion: Create an exclusion for traffic originating from the specific IP ranges or hostnames associated with your Endpoint Management servers (e.g., *.systemcenter.microsoft.com, *.update.microsoft.com) and restrict the rule to only trigger on non-standard ports or during off-hours if updates are scheduled.

• Cloud Backup Agents (e.g., Veeam, Commvault, or Azure Backup)

  • Scenario: Backup agents often poll external status endpoints or download configuration scripts from cloud storage providers. If a shared S3 bucket or an object storage endpoint used for storing backup metadata is tagged with d52f85, the daily scheduled backup jobs initiated by the service account will generate high-volume alerts, even though the traffic is strictly read-only and authenticated via service principals.
  • Filter/Exclusion: Exclude traffic where the User-Agent string contains specific keywords for your backup solution (e.g., VeeamBackupAgent, CommvaultService) or filter by the destination domain if it matches known, whitelisted cloud storage providers used exclusively for internal data replication.

• Security Information and Event Management (SIEM) Log Forwarders

  • **Scenario