URLhaus: 45-135-194-47 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving connections to a specific set of 14 malicious URLs associated with the IP address 45-135-194-47, which are known indicators of compromise for potential data exfiltration or command-and-control communication. Proactively hunting for these URLs in Azure Sentinel is critical to rapidly identify and isolate affected endpoints before adversaries can establish persistent access or initiate lateral movement within the network.

IOC Summary

Threat: 45-135-194-47 Total URLs: 14 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-135-194-47
let malicious_domains = dynamic(["45.135.194.47"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.135.194.47"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios and their corresponding filters/exclusions for the URLhaus: 45-135-194-47 Malicious URLs detection rule:

• Automated Cloud Backup Agents

  • Scenario: Scheduled backup agents (e.g., Veeam, Commvault, or Azure Backup) periodically contact the IP 45.135.194.47 to validate cloud storage connectivity or sync metadata before initiating a full backup job. The detection logic flags this routine heartbeat as a malicious URL interaction.
  • Filter/Exclusion: Create an exclusion rule for specific service accounts (e.g., svc-veeam-backup) and exclude traffic originating from the backup server subnet where the destination IP is 45.135.194.47 during defined maintenance windows (e.g., 02:00–06:00 UTC).

• Software Update Mechanisms

  • Scenario: Enterprise endpoint management tools like Microsoft Intune or SCCM (System Center Configuration Manager) utilize 45.135.194.47 as a secondary content distribution point for downloading patches and application updates. When the update service polls this IP, it triggers the rule despite being a trusted vendor connection.
  • Filter/Exclusion: Add an exclusion based on the process name Microsoft.Update.Service.exe or IntuneManagementExtension.exe. If the user agent string contains “MS-Client” or “SCCM-Agent,” suppress alerts for this specific destination IP.

• Third-Party SIEM Log Forwarding

  • Scenario: The organization’s Security Information and Event Management (SIEM) platform, such as Splunk Heavy Forwarders or QRadar APM agents, sends telemetry data to a cloud ingestion endpoint hosted at