URLhaus: 172-86-73-169-8081 Malicious URLs

Hunt Hypothesis

This hunt targets potential web-based intrusion attempts by identifying traffic to a specific IP and port (172.86.73.169:8081) associated with known malicious URLs, which often indicates compromised web assets or active phishing infrastructure. Proactively hunting for these connections in Azure Sentinel allows the SOC to detect early-stage lateral movement or data exfiltration attempts before they escalate into a full breach.

IOC Summary

Threat: 172-86-73-169-8081 Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 172-86-73-169-8081
let malicious_domains = dynamic(["172.86.73.169"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["172.86.73.169"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) running on the 172.86.73.169 host may have a hardcoded health check endpoint or API ping that periodically queries port 8081 to verify service availability. This is often configured in cron jobs or Windows Task Scheduler for monitoring tools like Nagios or Zabbix.
  • Filter/Exclusion: Exclude alerts where the source IP is a known monitoring server (e.g., 10.20.5.10) and the user-agent string contains Nagios or Zabbix-Agent.
• Development/Staging Environment Testing: Developers in the QA team may be running integration tests against a staging instance of the service hosted at 172.86.73.169:8081 using tools like Postman, cURL, or Python requests libraries. These tests are often scripted in CI/CD pipelines (e.g., Jenkins or GitLab CI) that run from build agents within the internal network.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the CI/CD build agent subnet (e.g., 192.168.100.0/24) and the process name is java.exe, node.exe, or python.exe.
• API Gateway or Reverse Proxy Logging: An internal API Gateway (e.g., Kong, NGINX, or HAProxy) might be configured to route traffic to the backend service at 172.86.73.169:8081. If the detection rule is based on DNS resolution or connection logs, the gateway’s own health check or upstream logging mechanism could trigger the rule.
  • *Filter/