URLhaus: 2-58-56-151 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where endpoints access known malicious URLs associated with the 2-58-56-151 threat signature, indicating potential web-based threats such as phishing or drive-by downloads. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the malicious content executes on user systems.

IOC Summary

Threat: 2-58-56-151 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 2-58-56-151
let malicious_domains = dynamic(["2.58.56.151"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["2.58.56.151"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 2-58-56-151 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query external vulnerability databases to check for the latest security updates. These tools often initiate HTTP/HTTPS requests to known feed URLs that may be flagged by URLhaus as “suspicious” due to high traffic volume or recent content changes, even though they are legitimate sources.
  • Filter/Exclusion: Create a rule exclusion based on the Source Process Name (e.g., ccmexec.exe for SCCM or IvantiAgent.exe) and restrict the alert if the destination URL domain matches known vendor domains (e.g., *.microsoft.com, *.ivanti.com).

• Scenario: Scheduled Cloud Backup Verification Jobs

  • Context: Automated backup solutions such as Veeam Backup & Replication or Rubrik run daily scheduled jobs that verify the integrity of cloud storage buckets. These jobs often trigger outbound connections to S3 endpoints or specific API gateways (e.g., *.aws.amazon.com or *.azure.com) which might be tagged by URLhaus due to dynamic subdomain generation, triggering a false positive on the 2-58-56-151 tag.
  • Filter/Exclusion: Implement an exclusion for traffic originating from specific Service Accounts (e.g., svc-backup-agent) or exclude URLs containing known cloud provider root domains (*.amazonaws.com, *.cloudapp.azure.com) when the source port is a standard backup service port.

• **Scenario: Third-Party CRM