URLhaus: 165-232-101-151 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints access known malicious web resources hosted on IP 165-232-101-151, indicating potential command-and-control communication or drive-by download attacks. The SOC team should proactively investigate these connections in Azure Sentinel to rapidly identify compromised assets and block lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 165-232-101-151 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 165-232-101-151
let malicious_domains = dynamic(["165.232.101.151"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["165.232.101.151"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 165-232-101-151 Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Antivirus Definition Updates via Central Management Console

  • Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) initiates a scheduled daily update. The background service connects to the vendor’s distribution server, which hosts a dynamic IP range including 165-232-101-151 to fetch signature databases and heuristic models.
  • Suggested Filter/Exclusion: Create an exclusion rule for traffic originating from known endpoint management services (e.g., process names like falcon.sys, SentinelOne.exe, or MsMpEng.exe) communicating with the specific URL path /update or /definitions. Alternatively, whitelist the IP 165-232-101-151 for the specific user account running these scheduled jobs (e.g., svc_antivirus_update).

• Cloud Backup Agent Repository Scans

  • Scenario: A cloud backup solution (such as Veeam, Rubrik, or Acronis Cyber Protect) performs a routine integrity check on the backup repository. The agent queries an external metadata service hosted at 165-232-101-151 to validate checksums and retrieve encryption keys for archived data blocks before the nightly backup window begins.
  • Suggested Filter/Exclusion: Exclude alerts where the source process is identified as a known backup agent (e.g., VeeamAgent.exe, rubrik-agent) and the destination URL contains specific query parameters related to metadata validation (