URLhaus: 164-92-204-248 Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging known malicious infrastructure from IP 164-92-204-248 to exfiltrate data or deliver payloads through compromised web traffic. Proactively hunting for these specific URLs in Azure Sentinel is critical to identify early-stage lateral movement and validate the effectiveness of current URL filtering policies before an active breach occurs.

IOC Summary

Threat: 164-92-204-248 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 164-92-204-248
let malicious_domains = dynamic(["164.92.204.248"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["164.92.204.248"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 164-92-204-248 Malicious URLs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scheduled Security Scanner Updates (CrowdStrike Falcon or SentinelOne)

  • Scenario: Endpoint protection agents automatically query the IP 164.92.204.248 to download signature definition updates or threat intelligence feeds during off-hours maintenance windows. This traffic is often misidentified as a malicious web request because the scanner uses a generic user-agent string that mimics a browser.
  • Filter/Exclusion: Create an exclusion for source IPs belonging to the “Endpoint Management” asset group and filter by User-Agent strings containing CrowdStrike or SentinelOne. Additionally, exclude traffic occurring between 02:00 and 04:00 UTC on weekdays.

• IT Admin Manual Patch Verification (Microsoft SCCM/MECM)

  • Scenario: System administrators manually trigger a “Health Check” job within the Microsoft Endpoint Configuration Manager console to verify patch compliance across the network. This process initiates an HTTP request to 164-92-204-248 to validate the integrity of a specific software repository or certificate, triggering the rule despite being a routine administrative task.
  • Filter/Exclusion: Exclude traffic originating from the “IT Operations” VLAN (e.g., subnet 10.50.10.0/24) where the destination port is 80 or 443 and the HTTP method is GET. Specifically, whitelist the hostname associated with the admin service account performing these checks.

• Third-Party Cloud Backup Agent (Veeam or Commvault)

  • Scenario: The enterprise