URLhaus: hta Malicious URLs

Hunt Hypothesis

This rule detects the execution of malicious HTML Application (HTA) files, a technique frequently exploited by adversaries to bypass security controls and establish initial footholds or execute payloads. Proactively hunting for these URLs in Azure Sentinel is critical because HTA files often operate in a trusted context, allowing attackers to run code with elevated privileges and evade standard endpoint detections.

IOC Summary

Threat: hta Total URLs: 8 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: hta
let malicious_domains = dynamic(["96.44.167.210"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["96.44.167.210"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Maintenance Scripts: A developer or DevOps engineer runs a local .hta script to automate the patching of a legacy internal tool (e.g., a custom-built inventory management system) that relies on a specific JavaScript library hosted on a shared internal CDN or a third-party update server. The URL might be a known benign endpoint for that specific library version.
  • Filter/Exclusion: Exclude URLs ending in specific library paths (e.g., /libs/jquery/) or filter by process name mshta.exe when the parent process is a known development tool (e.g., Code.exe, VisualStudio.exe, or cmd.exe initiated by a user in the DevOps group).
• Scheduled Backup Verification Jobs: An IT operations team uses a scheduled task to run an HTA script that queries a backup verification API endpoint to confirm job success and log the result to a local file. The URL points to a stable, internal REST API endpoint (e.g., http://backup-verify.internal/api/status).
  • Filter/Exclusion: Exclude URLs containing the internal domain suffix (e.g., .internal, .corp, .local) or filter by the scheduled task name (e.g., TaskName: "Backup_Verification") and the user account running it (e.g., User: "svc-backup").
• Browser Extension Auto-Update Checks: A corporate browser (e.g., Microsoft Edge or Chrome) or a specific line-of-business application (e.g., a custom PDF viewer) uses an HTA component to check for updates to a proprietary extension or plugin. The URL points to a vendor’s update server (e.g., https://updates.vendor.com/plugins/check).
  • Filter/Exclusion: Exclude URLs associated with known vendor update domains or filter by the parent process being a browser executable (e.g., `