URLhaus: 85-137-245-141-9001 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving access to specific malicious URLs associated with the 85-137-245-141-9001 threat signature, which often indicates potential phishing campaigns or command-and-control communications. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the adversary can establish a persistent foothold in the network.

IOC Summary

Threat: 85-137-245-141-9001 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 85-137-245-141-9001
let malicious_domains = dynamic(["85.137.245.141"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["85.137.245.141"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 85-137-245-141-9001 Malicious URLs detection rule, including targeted filters and exclusions:

• Automated Cloud Backup Synchronization

  • Scenario: The enterprise uses Veeam Backup & Replication or Acronis Cyber Protect, which periodically connects to the vendor’s update servers (often hosted on shared infrastructure) to download configuration patches. These connections may hit a URL flagged by the rule due to a recent reputation change in the underlying IP range, even though the traffic is strictly outbound and encrypted.
  • Filter/Exclusion: Create an exclusion for the specific Service Account or Host Group running the backup agents (e.g., HostGroup = "Backup_Servers") combined with a filter on the destination port: DestinationPort = 443 AND Direction = Outbound.

• Third-Party SIEM Log Forwarding

  • Scenario: The organization utilizes Splunk Universal Forwarders or Datadog Agents to ship telemetry data to a centralized cloud collector. If the collector’s endpoint URL is hosted on an IP that overlaps with the malicious tag 85-137-245-141-9001, legitimate log ingestion traffic will trigger alerts during scheduled high-volume windows (e.g., every 15 minutes).
  • Filter/Exclusion: Exclude traffic originating from the specific application process name: ProcessName = "splunkd.exe" or ProcessName = "datadog-agent.exe", and restrict the exclusion to business hours if the alert is only relevant during off-hours.

• Scheduled Software License Validation

  • Scenario: Critical enterprise software such as **Microsoft Office 365 ProPlus