URLhaus: 195-177-94-26 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving communication with known malicious URLs identified by URLhaus, specifically targeting the IP address 195.177.94-26 to identify potential command and control or phishing campaigns. A SOC team should proactively search for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the threat escalates.

IOC Summary

Threat: 195-177-94-26 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-26
let malicious_domains = dynamic(["195.177.94.26"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.26"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 195-177-94-26 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Microsoft Defender for Vulnerability Management) periodically probe external IP ranges to verify reachability and certificate validity. If the scanner’s default configuration includes 195-177-94-26 in its “trusted” or “public facing” list, it will generate HTTP/HTTPS requests that trigger this rule.
  • Suggested Filter: Create an exclusion based on the Source Host field for known scanner IPs (e.g., SourceIP IN [10.50.20.10, 10.50.20.11]) and restrict the rule to exclude traffic where the User Agent contains keywords like “Tenable,” “Qualys,” or “Defender.”

• Scenario: Scheduled Backup and Sync Jobs

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Acronis) often maintain heartbeat connections to cloud repositories or external update servers. If the IP 195-177-94-26 is part of a vendor’s CDN or update endpoint, nightly scheduled jobs running via Task Scheduler (Windows) or Cron (Linux) will initiate legitimate outbound traffic that mimics malicious URL access patterns.
  • Suggested Filter: Implement a time-based exclusion for the rule during known maintenance windows (e.g., Time BETWEEN 01:00 AND 05:00) and exclude specific service accounts (e.g., `AccountName =