URLhaus: 195-177-94-33 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of known malicious web resources identified by URLhaus, specifically targeting the IP address 195.177.94.33 which is associated with active threat campaigns. A SOC team should proactively hunt for this indicator in Azure Sentinel to identify potential initial access or command and control activities that may have bypassed standard perimeter defenses.

IOC Summary

Threat: 195-177-94-33 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-33
let malicious_domains = dynamic(["195.177.94.33"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.33"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 195-177-94-33 Malicious URLs detection rule:

• Scenario: Scheduled Software Update Scans

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) or patch management tools (e.g., SCCM/MECM) often initiate background connectivity checks to the URLhaus feed IP 195.177.94.33 to fetch the latest threat intelligence signatures during off-hours maintenance windows.
  • Filter: Create an exclusion rule that suppresses alerts where the source process is a known security agent (e.g., MsMpEng.exe, FalconSensorService) and the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Admin Manual Threat Intelligence Verification

  • Context: Security Operations Center (SOC) analysts or System Administrators frequently manually query the URLhaus API via command-line tools (PowerShell Invoke-WebRequest, cURL) or browser sessions to verify specific hash indicators before deploying new detection rules. These manual queries generate legitimate traffic to the IP.
  • Filter: Implement a user-based exclusion for accounts belonging to the “Security Admin” and “System Engineering” groups, specifically when the destination port is 443 (HTTPS) and the traffic volume is low (<50KB), indicating a query rather than a data download.

• Scenario: Third-Party SIEM/EDR Integration Sync

  • Context: Centralized logging platforms like Splunk, Elastic Security, or SentinelOne often run automated synchronization jobs to ingest URLhaus feeds into their local threat libraries. These scheduled jobs establish persistent connections to `195.177