URLhaus: 124-198-131-176 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving traffic to specific malicious URLs identified by URLhaus, which are likely indicators of command and control communication or phishing campaigns. Proactively hunting for these URLs in Azure Sentinel is critical to identify early-stage compromises and prevent potential data exfiltration before the threat escalates within the network.

IOC Summary

Threat: 124-198-131-176 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 124-198-131-176
let malicious_domains = dynamic(["124.198.131.176"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["124.198.131.176"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 124-198-131-176 Malicious URLs detection rule:

• Legacy Backup Agent Connectivity: The enterprise’s legacy backup solution (e.g., Veeam Backup & Replication) initiates daily scheduled jobs that query a specific vendor update server hosted on the IP 124.198.131.176 to check for license validation or plugin updates.

  • Suggested Filter: Create an exclusion rule allowing traffic from the Veeam Backup Service process (vbrservice.exe) destined for the specific URL path /api/license-check on IP 124.198.131.176.

• Automated Software Deployment: The IT operations team utilizes Microsoft Endpoint Configuration Manager (SCCM) to push monthly security patches. During the deployment window, SCCM clients download manifest files from a trusted third-party repository hosted at this IP address.

  • Suggested Filter: Exclude alerts generated by the SMS_EXECUTIVE service or ccmsetup.exe process accessing the domain associated with 124.198.131.176 between 02:00 and 06:00 UTC on weekdays.

• Cloud Storage Synchronization: The organization’s global file synchronization tool (OneDrive for Business) utilizes a regional Content Delivery Network (CDN) node at 124.198.131.176 to optimize large file uploads and block-level sync operations for users in the EMEA region.

  • Suggested Filter: Whitelist the OneDrive Sync Client (FileSync.exe) process when communicating with any URL containing the subdomain cdn-storage hosted on IP