URLhaus: 176-65-139-211 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving communication with a specific cluster of five malicious URLs associated with IP address 176.65.139.211, which may indicate active threat intelligence feeds or ongoing data exfiltration attempts. The SOC team should proactively hunt for this behavior in Azure Sentinel to validate the legitimacy of these connections and prevent potential compromise from known malicious infrastructure before it escalates into a broader incident.

IOC Summary

Threat: 176-65-139-211 Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-211
let malicious_domains = dynamic(["176.65.139.211"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.211"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters/exclusions for the URLhaus: 176-65-139-211 Malicious URLs detection rule:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager, Ivanti Neurons) frequently query the 176.65.139.211 IP range to validate software update signatures or download delta patches during scheduled maintenance windows. These legitimate HTTP/HTTPS requests often match the rule’s URL pattern but are not malicious.
  • Filter/Exclusion: Create an exclusion based on Source User and Process Name. Exclude alerts where the source user is SYSTEM (or a specific service account like svc-patchmgr) AND the process name matches known patching executables (e.g., ccmexec.exe, ivanti_agent.exe).

• Scenario: Cloud Backup Agent Heartbeats

  • Context: Cloud backup solutions such as Veeam Backup & Replication or Rubrik utilize the 176.65.139.211 IP for their global heartbeat and metadata synchronization services. The backup agents on workstations and servers periodically initiate connections to this IP, triggering the rule during routine backup cycles.
  • Filter/Exclusion: Implement a filter based on Destination Port and Traffic Volume. Exclude alerts where the destination port is 443 (HTTPS) AND the total bytes transferred are less than 50KB within a 60-second window, indicating a lightweight heartbeat rather than a large data exfiltration or download.

• Scenario: Third-Party SIEM/EDR Telemetry

  • Context: Security information and event