URLhaus: 64-89-163-215 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious URLs hosted on IP 64.89.163.215, which are known to distribute malware as flagged by the URLhaus threat intelligence feed. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malware can execute its payload or exfiltrate sensitive data.

IOC Summary

Threat: 64-89-163-215 Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 64-89-163-215
let malicious_domains = dynamic(["64.89.163.215"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["64.89.163.215"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 64-89-163-215 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Automated Endpoint Security Health Checks

  • Scenario: The corporate EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs daily telemetry uploads to the vendor’s cloud console. If the EDR service account connects to an update server hosted on 64-89-163-215 (or a subdomain thereof) during its scheduled maintenance window, the URL request may be flagged as malicious by URLhaus due to shared infrastructure or recent certificate changes.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from the specific EDR service account SID (e.g., NT SERVICE\CrowdStrikeService) connecting to the destination IP 64-89-163-215 during the defined maintenance window (02:00–04:00 UTC).

• Third-Party Cloud Backup Synchronization

  • Scenario: The enterprise utilizes a cloud backup solution like Veeam or Acronis Cyber Protect. During nightly backup jobs, the backup proxy server initiates a connection to the vendor’s API gateway located at 64-89-163-215 to sync metadata and verify repository integrity. This routine administrative traffic often triggers URLhaus alerts if the specific IP is newly listed or flagged globally but benign for this specific use case.
  • Filter/Exclusion: Add a whitelist entry in the proxy firewall (e.g., Zscaler or Palo Alto Networks) allowing all HTTPS traffic from the Backup Proxy Server subnet (10.20.5.0/24) to `64-