URLhaus: 176-65-139-232 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious web resources associated with the IP address 176.65.139.232, which are flagged by URLhaus as active threats. A SOC team should proactively investigate these URLs in Azure Sentinel to rapidly identify potential initial access or command-and-control activities before they escalate into broader compromise incidents within the organization’s network.

IOC Summary

Threat: 176-65-139-232 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-232
let malicious_domains = dynamic(["176.65.139.232"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.232"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 176-65-139-232 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Cloud Backup Syncing to Vendor Storage

  • Context: Enterprise backup agents (e.g., Veeam, Rubrik, or Commvault) initiate scheduled jobs every night at 02:00 AM to sync metadata and logs to the vendor’s cloud portal hosted on 176.65.139.232. The detection logic flags these outbound HTTPS connections as malicious because the IP is tagged in URLhaus, but the traffic represents legitimate backup operations.
  • Suggested Filter/Exclusion: Create a rule exclusion based on Process Name (VeeamBackupService.exe or rubrik-agent) and Destination Port 443. Additionally, add the specific IP range of the backup vendor’s data center to the allow-list if the URL path matches known backup endpoints (e.g., /api/v1/sync).

• Scenario: Third-Party SaaS Integration Webhooks

  • Context: The organization utilizes a CRM platform (Salesforce) or an HR system (Workday) that pushes real-time data via webhooks to an external analytics dashboard hosted on the IP 176.65.139.232. These periodic JSON payload transmissions trigger the rule, mistaking the legitimate API callback for a potential phishing or malware download event.
  • Suggested Filter/Exclusion: Implement a filter that excludes traffic where the User-Agent string contains specific identifiers (e.g., Salesforce-Webhook, Workday-API) and the HTTP method is strictly POST. Ensure the exclusion applies only to the specific sub-domain or URL path associated with