URLhaus: 45-88-186-14 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of malicious payloads from known threat intelligence feeds, specifically identifying traffic to the URLhaus source IP 45-88-186-14 which indicates active malware distribution. A proactive search in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement before the associated malware can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: 45-88-186-14 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-88-186-14
let malicious_domains = dynamic(["45.88.186.14"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.88.186.14"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: 45-88-186-14 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external resources to validate certificate validity or check for known malicious indicators. These tools often generate high-volume traffic that mimics malware beaconing behavior by querying the specific IP range associated with URLhaus feeds.
  • Suggested Filter: Exclude traffic originating from the specific service accounts or IP ranges of your security scanning infrastructure.
    • Filter Logic: Source_IP IN (10.20.5.1, 10.20.5.2) AND Host_Name CONTAINS "Tenable-Scanner"

• Scenario: Scheduled Patch Management & Update Checks

  • Context: Enterprise endpoint management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons perform scheduled daily jobs to check for software updates and security definitions. These agents frequently connect to the URLhaus feed IP (45-88-186-14) to download threat intelligence data, which can trigger a “Malicious URL” alert due to the nature of the connection.
  • Suggested Filter: Create an exclusion based on the specific process name and scheduled time window.
    • Filter Logic: Process_Name IN ("ccmsetup.exe", "IvantiAgent.exe") AND (Time BETWEEN 02:00 AND 04:00)

• Scenario: Cloud Backup & Synchronization Agents

  • Context: Cloud backup solutions such as **V