URLhaus: 45-154-98-126 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving initial access or command-and-control communications through specific malicious URLs associated with the IP address 45-154-98-126. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage compromise attempts before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Threat: 45-154-98-126 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-154-98-126
let malicious_domains = dynamic(["45.154.98.126"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.154.98.126"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 45-154-98-126 Malicious URLs detection rule, tailored for an enterprise environment:

• Automated Security Scanner Health Checks

  • Scenario: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) perform scheduled daily health checks against the IP 45.154.98.126. These scans often initiate HTTP/HTTPS requests to validate endpoint availability and certificate validity, which can be misidentified as user-initiated browsing activity by the detection logic.
  • Suggested Filter: Create an exclusion based on the Source Host or Process Name. Exclude traffic originating from known scanner service accounts (e.g., svc-nessus-agent) or specific IP ranges assigned to the vulnerability management infrastructure.

• Software Update and Patch Management Deployments

  • Scenario: Enterprise patching tools like Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Jamf Pro utilize 45.154.98.126 as a trusted upstream repository for downloading security definitions, firmware updates, or application patches. The background service processes (ccmexec.exe, jamf.exe) generate high-volume traffic to this IP during maintenance windows.
  • Suggested Filter: Implement a filter on the Destination URL Path combined with Process Name. Exclude requests where the process is identified as a known patch management agent and the request path contains standard update keywords (e.g., /updates/, /feed/, or specific version strings).

• Cloud Backup and Data Synchronization Services

  • Scenario: Scheduled backup jobs using tools like Veeam Backup & Replication, Rubrik, or **