URLhaus: 45-141-119-82 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving known malicious URLs from the URLhaus threat intelligence feed, specifically targeting the IP address 45-141-119-82 which is associated with active web-based threats. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent potential data exfiltration or lateral movement before broader network impact occurs.

IOC Summary

Threat: 45-141-119-82 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-141-119-82
let malicious_domains = dynamic(["45.141.119.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.141.119.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 45-141-119-82 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query external vulnerability databases to check for the latest patches. These agents often initiate connections to known update servers that may share IP ranges with the flagged malicious URL, triggering a false alert during scheduled maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the specific process name (e.g., ccmsetup.exe or ivantiagent.exe) and exclude traffic originating from the dedicated patch management server subnets (e.g., 10.20.50.0/24).

• Scenario: Cloud Backup Agent Heartbeats

  • Context: Cloud backup solutions such as Veeam Backup & Replication or Rubrik perform periodic heartbeat checks and metadata synchronization with their cloud gateways. If the gateway IP 45-141-119-82 (or a related range) is part of the vendor’s infrastructure, legitimate backup agents will trigger this rule during their daily scheduled jobs.
  • Suggested Filter/Exclusion: Implement a whitelist for the specific service account used by the backup agent (e.g., VeeamBackupService) and exclude URLs containing the vendor-specific domain suffix (e.g., *.veeam.com or *.rubrik.com) regardless of the IP match.

• Scenario: SIEM Log Forwarding to External Threat Intelligence

  • Context: The organization’s Security Information and Event Management (SIEM) platform