URLhaus: 193-111-117-135 Malicious URLs

Hunt Hypothesis

This hunt targets potential compromise vectors by identifying assets that have interacted with three specific malicious URLs associated with the 193-111-117-135 tag, which often indicate active phishing campaigns or drive-by downloads. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect early-stage web-based intrusions and isolate affected endpoints before adversaries can establish persistence or exfiltrate data.

IOC Summary

Threat: 193-111-117-135 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 193-111-117-135
let malicious_domains = dynamic(["193.111.117.135"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["193.111.117.135"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A network monitoring tool (e.g., Wireshark or Zeek/Bro) or a web proxy (e.g., Squid or Nginx) is configured to fetch specific health check endpoints or benchmark pages that happen to match the IP/URL pattern 193.111.117.135 for performance testing or connectivity verification.
  • Filter/Exclusion: Exclude alerts where the source process is a known network monitoring agent (e.g., wireshark.exe, zeekctl, squid.exe) or where the user agent string contains “HealthCheck” or “Benchmark”.
• Scenario: A developer or QA engineer is manually testing a new API integration or debugging a client-side JavaScript application in a browser (e.g., Chrome or Firefox) that references the URL http://193.111.117.135/... as a temporary placeholder or test endpoint during a staging deployment.
  • Filter/Exclusion: Exclude alerts if the source process is a standard web browser (chrome.exe, firefox.exe, msedge.exe) and the user account belongs to a “Development” or “QA” security group, or if the URL path contains common test identifiers like /test, /dev, or /staging.
• Scenario: A scheduled backup or synchronization job (e.g., Veeam, Rubrik, or a custom PowerShell script) is configured to verify connectivity to a remote storage node or metadata server that resides at 193.111.117.135 before initiating the backup cycle.
  • Filter/Exclusion: Exclude alerts if the source process is a backup agent (e.g., veeam.exe, rubik-agent.exe, `powers