URLhaus: 2-58-56-111 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious web resources flagged by URLhaus under signature 2-58-56-111, which often indicate active phishing campaigns or command-and-control communication channels. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify compromised endpoints and mitigate potential data exfiltration before the threat spreads across the organization’s network perimeter.

IOC Summary

Threat: 2-58-56-111 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 2-58-56-111
let malicious_domains = dynamic(["2.58.56.111"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["2.58.56.111"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding mitigation strategies for the URLhaus: 2-58-56-111 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Enterprise security appliances (e.g., CrowdStrike Falcon, Palo Alto Networks Cortex XDR, or SentinelOne) perform periodic outbound connectivity tests to verify their ability to reach threat intelligence feeds. These agents often query specific URLhaus endpoints to validate signature updates, triggering the rule even though the traffic is benign and expected.
  • Filter/Exclusion: Create a detection exclusion based on the Source Host Group or Process Name. Exclude any network activity where the initiating process matches falcon.sys, CortexXDR.exe, or SentinelOneAgent.exe connecting to the specific URLhaus IP range (2-58-56-111).

• Scenario: Scheduled Cloud Backup and Sync Operations

  • Context: Background services like Microsoft OneDrive for Business, Google Workspace Drive, or Veeam Backup & Replication often utilize cloud-based threat intelligence APIs to scan files before upload. During scheduled maintenance windows (e.g., nightly at 02:00 AM), these tools may fetch metadata from the URLhaus endpoint, generating a hit that mimics user browsing behavior but is actually part of a backup routine.
  • Filter/Exclusion: Implement a time-based exclusion or filter logic that suppresses alerts for this rule during defined maintenance windows (e.g., 01:00 to 04:00). Alternatively, exclude traffic originating from the specific service accounts used by these tools (e.g., svc-onedrive-backup, veeam-svc) using Active Directory Group filtering.