URLhaus: 217-60-241-91 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the consumption of specific malicious URLs associated with IP address 217.60.241.91, signaling potential web-based threats such as phishing or drive-by downloads. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before broader network impact occurs.

IOC Summary

Threat: 217-60-241-91 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 217-60-241-91
let malicious_domains = dynamic(["217.60.241.91"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.60.241.91"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 217-60-241-91 Malicious URLs detection rule, along with targeted filtering strategies:

• Scheduled Cloud Backup Agent Polling

  • Scenario: The enterprise uses Veeam Backup & Replication or Rubrik, which runs nightly scheduled jobs to query the vendor’s update servers. These agents periodically fetch configuration manifests from a shared CDN IP that coincides with 217.60.241.91, triggering the rule during maintenance windows (e.g., 02:00–04:00 UTC).
  • Filter/Exclusion: Create an exclusion based on the Process Name (Veeam.Backup.Service.exe or rubrik-agent) combined with a Time Window constraint. Alternatively, whitelist the specific URL path (e.g., *.cloud-vendor.com/api/status) if the IP is shared across multiple legitimate endpoints.

• Third-Party SIEM Log Forwarding

  • Scenario: The organization utilizes Splunk Universal Forwarders or Datadog Agents to push telemetry data to a centralized cloud ingestion point hosted at this IP address. During high-volume log bursts, the forwarder sends HTTP POST requests that match the malicious URL signature due to shared infrastructure with the threat intelligence provider.
  • Filter/Exclusion: Implement a filter excluding traffic where the User-Agent string contains specific identifiers (e.g., SplunkUniversalForwarder or DatadogAgent) and the HTTP Method is strictly POST.

• Automated Patch Management Scans

  • Scenario: The IT operations team runs Microsoft SCCM (Configuration Manager) or Ivanti Neurons to deploy security patches. These tools initiate