URLhaus: 185-139-214-200 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of specific malicious web resources identified by URLhaus, which may indicate initial reconnaissance or command-and-control communication for active threats. The SOC team should proactively hunt for these URLs in Azure Sentinel to rapidly identify and isolate compromised endpoints before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: 185-139-214-200 Total URLs: 15 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 185-139-214-200
let malicious_domains = dynamic(["185.139.214.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["185.139.214.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusions for the URLhaus: 185-139-214-200 Malicious URLs detection rule in a legitimate enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to verify certificate validity and service availability. These tools often generate HTTP requests to the specific IP 185-139-214-200 as part of their baseline health checks, triggering the rule despite the traffic being benign.
  • Filter/Exclusion: Create a detection filter that excludes traffic where the Source User Agent contains keywords like “Nessus,” “Qualys,” or “Rapid7,” OR exclude traffic originating from specific Scanner Subnets (e.g., 10.20.50.0/24) known to host these tools.

• Scenario: Cloud Backup and Sync Operations

  • Context: Enterprise file synchronization services (such as Microsoft OneDrive for Business, Box Enterprise, or Dropbox) often utilize a shared pool of backend IPs for content delivery networks (CDN). The IP 185-139-214-200 may be part of the CDN infrastructure used by these tools to upload/download large datasets during scheduled backup windows, generating legitimate URL connections.
  • Filter/Exclusion: Implement an exclusion based on Destination Port (e.g., 443 for HTTPS) combined with a whitelist of known CDN IP ranges. Additionally, exclude events occurring only during defined maintenance windows (e.g., 02:00 - 06:00 UTC) where bulk sync jobs