URLhaus: 195-177-94-80 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving web traffic to known malicious URLs associated with the IP address 195.177.94.80, which often indicates active phishing campaigns or command-and-control communications. Proactively hunting for these specific indicators in Azure Sentinel is critical due to their high severity rating, allowing the SOC team to identify and contain potential data exfiltration or initial access threats before they escalate into broader incidents.

IOC Summary

Threat: 195-177-94-80 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-80
let malicious_domains = dynamic(["195.177.94.80"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.80"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding filters for the URLhaus: 195-177-94-80 Malicious URLs detection rule in a legitimate enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to verify SSL certificates and reachability. These scanners often generate HTTP/HTTPS requests that match the pattern of the malicious IP 195.177.94.80 if the scanner itself resolves to this IP or if it is probing a known service hosted there.
  • Suggested Filter: Create an exclusion rule based on the source user agent string containing specific keywords (e.g., Tenable, Qualys, Rapid7) or exclude traffic originating from the internal subnet of the security scanning appliance (e.g., 10.50.20.0/24).

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup perform scheduled synchronization tasks that connect to cloud storage gateways. If the gateway service for a specific region utilizes 195.177.94.80 as an endpoint, the nightly sync job will trigger this rule repeatedly during its window (e.g., 02:00–04:00 UTC).
  • Suggested Filter: Implement a time-based exclusion allowing traffic from known backup service accounts (e.g., svc-backup-azure) to this specific URL/IP only between defined maintenance windows, or whitelist the destination IP if it is confirmed as part of the vendor’s infrastructure.

• **Scenario: Third-