URLhaus: 194-26-192-131 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving connections to malicious URLs identified by URLhaus at IP address 194.26.192.131, which are frequently associated with phishing campaigns and malware distribution. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify compromised endpoints and prevent potential data exfiltration or lateral movement before broader network impact occurs.

IOC Summary

Threat: 194-26-192-131 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 194-26-192-131
let malicious_domains = dynamic(["194.26.192.131"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["194.26.192.131"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 194-26-192-131 Malicious URLs detection rule, along with targeted filters and exclusions:

• Scenario: Automated Security Tool Health Checks

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically ping external threat intelligence feeds to validate connectivity and update local reputation databases. The IP 194-26-192-131 is often part of these upstream feed servers, triggering the rule when agents initiate outbound HTTPS connections during their scheduled maintenance windows (e.g., 02:00–04:00 daily).
  • Filter/Exclusion: Exclude traffic originating from specific EDR service accounts or process names (e.g., C:\Program Files\CrowdStrike\fs_qscan.exe or MsMpEng.exe) where the destination URL contains known feed domains associated with the tool vendor.

• Scenario: Scheduled Cloud Backup and Sync Operations

  • Context: Corporate backup solutions like Veeam or Acronis Cyber Protect utilize external storage gateways that may route traffic through this specific IP range for metadata synchronization or block-level verification. During nightly backup jobs, these agents generate high-volume HTTP/HTTPS requests to 194-26-192-131 which are misidentified as malicious user browsing activity.
  • Filter/Exclusion: Create a whitelist entry for the specific process paths of the backup software (e.g., C:\Program Files\Veeam\Backup and Replication\Engine\veeamengine.exe) and exclude connections occurring during defined maintenance windows (e.g., 20:00–06:00).

• Scenario: Third-Party SaaS Integration Webhooks