URLhaus: 167-71-81-147 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access known malicious infrastructure associated with IP 167-71-81-147, indicating potential command-and-control communication or phishing campaigns. The SOC team should proactively investigate these connections in Azure Sentinel to rapidly identify compromised hosts and block lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 167-71-81-147 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 167-71-81-147
let malicious_domains = dynamic(["167.71.81.147"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["167.71.81.147"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 167-71-81-147 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Automated Patch Management Scans by WSUS/SCCM

  • Scenario: The Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager (MECM/SCCM) servers periodically scan the 167.71.81.147 IP range to verify the integrity of update manifests or download specific security patches for a third-party vendor application. This generates legitimate outbound traffic that mimics the malicious signature due to shared infrastructure.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., WSUS-Primary and SCCM-DP01) combined with specific Process Names (wsusclient.exe, ccmexec.exe). Alternatively, whitelist the destination IP if it is confirmed as a trusted update repository for your organization’s software stack.

• Scheduled Antivirus Definition Updates via CrowdStrike/Falcon

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender) performs a scheduled “Cloud Intelligence” check at 02:00 AM daily. During this window, the agent queries 167.71.81.147 to fetch threat intelligence feeds or verify cloud-based sandboxing results for recently scanned files, triggering the URLhaus alert on the network proxy logs.
  • Filter/Exclusion: Exclude traffic originating from the Antivirus Service process (e.g., csagent.exe, MsMpEng.exe) during off-hours (01:00–04:00). Implement a time-based filter to suppress alerts for this specific IP range when