URLhaus: 37-77-150-120 Malicious URLs

Hunt Hypothesis

This hypothesis detects adversary behavior involving the consumption of newly identified malicious URLs from the URLhaus threat intelligence feed, specifically targeting the signature associated with IP 37-77-150-120 to identify potential command-and-control or phishing activities. A SOC team should proactively hunt for this indicator in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malicious URLs are fully propagated across the broader threat landscape.

IOC Summary

Threat: 37-77-150-120 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 37-77-150-120
let malicious_domains = dynamic(["37.77.150.120"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["37.77.150.120"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 37-77-150-120 Malicious URLs detection rule:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Nessus Essentials) periodically probe external endpoints to verify connectivity and certificate validity. These tools often generate outbound HTTP/HTTPS requests that match the signature of the malicious URL pattern, specifically when scanning public-facing web servers hosted on IP ranges overlapping with 37-77-150-120.
  • Suggested Filter: Create an exclusion rule based on the Source Hostname or Process Name. Exclude alerts where the initiating process is nessus.exe, qualyspc_agent.exe, or tenable.scanner and the destination URL contains the specific hash signature of the scanner’s update server.

• Scenario: Scheduled Cloud Backup Agent Updates

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik run scheduled jobs during off-hours (e.g., 02:00 - 04:00) to fetch metadata, policy definitions, or delta updates from their cloud management portals. These agents often connect to a shared CDN IP range that includes 37-77-150-120, triggering the rule when downloading large configuration manifests.
  • Suggested Filter: Implement a time-based exclusion window combined with a process filter. Exclude alerts occurring between 01:00 and 05:00 on weekdays where the source process is Veeam.Backup.Service.exe or rubrik-agent, provided the traffic volume exceeds 5MB (indicating a bulk update rather than a suspicious small beacon).