URLhaus: MassLogger Malicious URLs

Hunt Hypothesis

This hypothesis targets adversary activity involving the MassLogger malware, which often leverages malicious URLs to establish command-and-control channels or deliver payloads during initial access or post-compromise operations. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious web traffic before the malware fully propagates or exfiltrates data, reducing the mean time to detection for high-severity threats.

IOC Summary

Threat: MassLogger Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: MassLogger
let malicious_domains = dynamic(["5.175.169.207"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.175.169.207"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a local proxy tool like Fiddler or Charles Proxy to intercept and inspect HTTPS traffic during API debugging sessions. The tool may cache or log the specific malicious URLs (e.g., http://192.168.1.50:8080/masslogger) in its local database or temporary logs, which are then picked up by the hunt package if it scans local application data or network flow logs.

  • Filter/Exclusion: Exclude source IPs belonging to known developer workstations or CI/CD build agents. Additionally, filter out traffic where the User-Agent string contains “Fiddler” or “Charles” or where the destination port is a non-standard HTTP/HTTPS port (e.g., 8888, 8080) commonly used by local proxies.

• Scenario: An IT administrator performs a manual security assessment or penetration test using Burp Suite or OWASP ZAP to validate web application security. These tools often replay requests to known endpoints, including test or staging URLs that might coincidentally match the MassLogger indicators if the test environment mirrors production or if the tool’s internal cache is scanned.

  • Filter/Exclusion: Exclude sessions where the User-Agent contains “Burp” or “ZAP”. Alternatively, create a tag in the SIEM for hosts labeled as “PenTest” or “SecurityAssessment” and exclude them from this specific hunt rule.

• Scenario: A scheduled job using Curl or Wget (common in Linux-based CI/CD pipelines or backup scripts) performs health checks or data synchronization against a staging server that has been temporarily configured to serve the MassLogger payload for testing purposes. The network flow logs record the exact URL access, triggering the detection.

  • Filter/Exclusion: Exclude