URLhaus: DPRK Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints or cloud workloads communicate with six specific malicious URLs associated with North Korean (DPRK) threat actors to deliver payloads or exfiltrate data. Proactively hunting for these indicators in Azure Sentinel is critical because DPRK groups frequently employ targeted web-based initial access vectors that may bypass standard signature-based defenses, requiring immediate correlation of network logs against this curated list to prevent potential compromise.

IOC Summary

Threat: DPRK Total URLs: 6 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: DPRK
let malicious_domains = dynamic(["filament-zap.vercel.app", "svganchordev.net", "23.27.180.36"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["filament-zap.vercel.app", "svganchordev.net", "23.27.180.36"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: DPRK Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Security Team Threat Intelligence Feeds and Research

  • Scenario: Security analysts using tools like Splunk, Microsoft Sentinel, or CrowdStrike Falcon often run scheduled queries to pull the latest threat intelligence feeds. If the security team actively monitors DPRK (North Korean) cyber activities, their internal dashboards or automated scripts may explicitly query the specific URLhaus endpoints to validate the “6 malicious URLs” tags before they are fully retired from the feed.
  • Filter/Exclusion: Create an exclusion for traffic originating from the Security Operations Center (SOC) subnet or specific host groups tagged as Role=ThreatIntel. Additionally, filter out requests where the User-Agent string contains keywords like curl, Python-requests, or the internal SIEM collector name.

• Endpoint Protection Update and Signature Refresh Jobs

  • Scenario: Enterprise Endpoint Detection and Response (EDR) platforms such as CrowdStrike, SentinelOne, or Trend Micro perform daily scheduled jobs to update their threat definition signatures. These updates often include a “pre-check” phase where the agent pings known malicious URL repositories (including URLhaus DPRK lists) to verify connectivity and download delta packages, triggering the detection logic even though no user is actively browsing a compromised site.
  • Filter/Exclusion: Exclude traffic generated by specific service accounts or processes responsible for updates, such as CrowdStrike Falcon Sensor Service, SentinelOne Agent Service, or Windows Update Orchestrator. Filter based on the destination port (e.g., 443) combined with a known internal IP range dedicated to Patch Management Servers.

• **IT Admin Compliance and Asset Discovery Sc