URLhaus: 178-16-55-154 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access known malicious URLs identified by URLhaus, specifically targeting threats associated with the IP address 178.16.55.154 to identify potential command and control or phishing activities. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the adversary can establish a persistent foothold within the network.

IOC Summary

Threat: 178-16-55-154 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 178-16-55-154
let malicious_domains = dynamic(["178.16.55.154"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["178.16.55.154"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 178-16-55-154 Malicious URLs detection rule:

• Scenario: Automated Security Scanner Traffic

  • Context: External vulnerability scanners (e.g., Qualys, Tenable Nessus) or internal security bots periodically probe public-facing assets. These tools often initiate HTTP/HTTPS requests to verify endpoint availability or certificate validity, which may inadvertently hit the specific malicious URL signature if the scanner’s logic includes broad URL pattern matching.
  • Filter/Exclusion: Create an exclusion rule based on the Source IP Address of known security scanning appliances (e.g., 10.20.5.10 for Qualys) or filter by Process Name if the traffic originates from a specific service account (e.g., QualysPC.exe).

• Scenario: Scheduled Backup and Cloud Sync Operations

  • Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync tools like OneDrive for Business often perform scheduled jobs during off-hours. These applications may query specific metadata endpoints or synchronization URLs that share a similar domain structure or path pattern with the malicious signature 178-16-55-154.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 - 06:00 UTC) combined with an exclusion on specific Process Paths such as C:\Program Files\Microsoft Office\root\Office16\OneDrive.exe or C:\Program Files\Veeam\Veeam Backup and Replication\vbagent.exe.

• Scenario: Third-Party API Integration for CRM/ERP Systems

  • Context: Business applications such as Salesforce, SAP, or Microsoft Dynamics often maintain persistent connections