URLhaus: 161-35-71-130 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of web traffic directed toward known malicious infrastructure identified by URLhaus as IP 161.35.71.130, which often indicates active command-and-control communication or initial phishing delivery. Proactively hunting for these specific URLs in Azure Sentinel is critical to rapidly identify compromised endpoints and block lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 161-35-71-130 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 161-35-71-130
let malicious_domains = dynamic(["161.35.71.130"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["161.35.71.130"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 161-35-71-130 Malicious URLs detection rule:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike, Microsoft Defender for Endpoint, or Carbon Black) frequently initiate background connectivity checks to vendor update servers. If the IP 161-35-71-130 hosts a legitimate software repository or CDN node used by these agents, their scheduled “health check” or “delta download” tasks will trigger the rule every morning between 2:00 AM and 4:00 AM across all workstations.
  • Suggested Filter: Create an exclusion for traffic originating from specific service accounts (e.g., svc-antivirus-updater) or filter by process name (MsMpEng.exe, csagent.exe) accessing the URL, provided the destination port is standard HTTPS (443) and no user interaction is logged.

• Scheduled IT Asset Inventory and Compliance Scans

  • Scenario: Network discovery tools like Lansweeper, SolarWinds NPM, or Qualys perform routine asset inventory scans. These tools often ping external IP ranges to verify DNS resolution and SSL certificate validity for known infrastructure partners. If 161-35-71-130 is a registered partner server (e.g., a cloud storage gateway or API endpoint), the scheduled “Network Discovery” job running every Sunday at 00:00 will generate a high volume of HTTP GET requests that match the malicious URL signature.
  • Suggested Filter: Exclude traffic generated by specific scan appliances or management servers (identified by their internal IP range, e.g., 10.20.50.x) during the defined