URLhaus: 176-65-139-239 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving connections to a specific set of 14 malicious URLs associated with the IP address 176.65.139.239, which are known indicators of compromise for potential phishing or malware distribution campaigns. The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before the adversary can establish persistence within the network.

IOC Summary

Threat: 176-65-139-239 Total URLs: 14 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-239
let malicious_domains = dynamic(["176.65.139.239"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.239"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 176-65-139-239 Malicious URLs detection rule, including targeted filters and exclusions:

• Scheduled Security Tool Updates: The enterprise’s endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) initiates a daily scheduled update task at 02:00 AM that queries the IP 176.65.139.239 to fetch the latest threat intelligence feeds and rule definitions.

  • Filter/Exclusion: Create an exclusion rule that suppresses alerts for this specific detection when the source process is identified as the security agent’s update service (e.g., C:\Program Files\CrowdStrike\fsquarant.exe or MsMpEng.exe) and the event occurs between 01:30 AM and 04:00 AM.

• Cloud Backup Synchronization: The organization utilizes a cloud backup solution like Veeam Backup & Replication which periodically connects to an external repository hosted at this IP address to verify data integrity and sync metadata during off-peak hours.

  • Filter/Exclusion: Add the specific hostname or IP 176.65.139.239 to the “Trusted External IPs” allow-list within the SIEM correlation engine, specifically for traffic originating from the backup server subnet (e.g., 10.20.40.0/24).

• Software License Verification: Internal development teams use a SaaS platform (e.g., Autodesk or Adobe Creative Cloud) that performs automated license validation checks against this IP address every 4 hours to ensure compliance for enterprise software usage.

  • Filter/Exclusion: Implement a logic filter that excludes