Unraveling Threat Intelligence Through the Lens of Malicious URL Campaigns

TL;DR

This paper analyzes malicious URL campaigns from SIEM alerts, grouping millions of URLs into campaigns to reveal threat patterns, evasive tactics, and gaps in detection, thereby enhancing threat intelligence for SOC teams.

Contribution

It introduces a campaign-based analysis of malicious URLs from large-scale data, uncovering thousands of campaigns and highlighting detection gaps without relying on machine learning.

Findings

Identified 77,800 malicious URL campaigns from 311 million records.

Only 2.97% of campaigns were detected by security vendors.

Revealed evasive tactics like longer URLs and diverse domains.

Abstract

The daily deluge of alerts is a sombre reality for Security Operations Centre (SOC) personnel worldwide. They are at the forefront of an organisation's cybersecurity infrastructure, and face the unenviable task of prioritising threats amongst a flood of abstruse alerts triggered by their Security Information and Event Management (SIEM) systems. URLs found within malicious communications form the bulk of such alerts, and pinpointing pertinent patterns within them allows teams to rapidly deescalate potential or extant threats. This need for vigilance has been traditionally filled with machine-learning based log analysis tools and anomaly detection concepts. To sidestep machine learning approaches, we instead propose to analyse suspicious URLs from SIEM alerts via the perspective of malicious URL campaigns. By first grouping URLs within 311M records gathered from VirusTotal into 2.6M suspicious clusters, we thereafter discovered 77.8K malicious campaigns. Corroborating our suspicions, we found 9.9M unique URLs attributable to 18.3K multi-URL campaigns, and that worryingly, only 2.97% of campaigns were found by security vendors. We also confer insights on evasive tactics such as ever lengthier URLs and more diverse domain names, with selected case studies exposing other adversarial techniques. By characterising the concerted campaigns driving these URL alerts, we hope to inform SOC teams of current threat trends, and thus arm them with better threat intelligence.