  The daily deluge of alerts is a sombre reality for Security Operations Centre
(SOC) personnel worldwide. They are at the forefront of an organisation's
cybersecurity infrastructure, and face the unenviable task of prioritising
threats amongst a flood of abstruse alerts triggered by their Security
Information and Event Management (SIEM) systems. URLs found within malicious
communications form the bulk of such alerts, and pinpointing pertinent patterns
within them allows teams to rapidly deescalate potential or extant threats.
This need for vigilance has been traditionally filled with machine-learning
based log analysis tools and anomaly detection concepts. To sidestep machine
learning approaches, we instead propose to analyse suspicious URLs from SIEM
alerts via the perspective of malicious URL campaigns. By first grouping URLs
within 311M records gathered from VirusTotal into 2.6M suspicious clusters, we
thereafter discovered 77.8K malicious campaigns. Corroborating our suspicions,
we found 9.9M unique URLs attributable to 18.3K multi-URL campaigns, and that
worryingly, only 2.97% of campaigns were found by security vendors. We also
confer insights on evasive tactics such as ever lengthier URLs and more diverse
domain names, with selected case studies exposing other adversarial techniques.
By characterising the concerted campaigns driving these URL alerts, we hope to
inform SOC teams of current threat trends, and thus arm them with better threat
intelligence.
