URLhaus: 94-154-32-173 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving the consumption of specific malicious URLs identified by URLhaus (tagged 94-154-32-173), which often indicate initial phishing campaigns or command-and-control communications. The SOC team should proactively investigate these signals within Azure Sentinel to rapidly identify compromised endpoints and prevent potential data exfiltration or lateral movement before the threat escalates.

IOC Summary

Threat: 94-154-32-173 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-173
let malicious_domains = dynamic(["94.154.32.173"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.173"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters/exclusions for the URLhaus: 94-154-32-173 Malicious URLs detection rule:

• Scheduled Cloud Backup Agent Connectivity

  • Scenario: The enterprise’s backup solution (e.g., Veeam Backup & Replication or Rubrik) performs nightly health checks and metadata synchronization by connecting to the vendor’s update servers. If the IP 94.154.32.173 belongs to a CDN node used by these vendors, the agent will generate HTTP/HTTPS requests that match the malicious URL signature, triggering an alert during the 02:00–04:00 maintenance window.
  • Filter/Exclusion: Create a rule exclusion based on the Source Process Name (e.g., Veeam.Backup.Service.exe or rubrik-agent) and restrict the alert to fire only outside of the defined maintenance window (e.g., exclude events occurring between 02:00 and 04:00 UTC).

• Third-Party SIEM Log Forwarding

  • Scenario: The organization utilizes a centralized logging platform like Splunk Universal Forwarder or Datadog Agent. These agents periodically send heartbeat signals, configuration updates, or compressed log batches to the vendor’s ingestion endpoint hosted at 94.154.32.173. This routine traffic is often misidentified as a user-initiated malicious URL visit rather than infrastructure telemetry.
  • Filter/Exclusion: Exclude events where the Source Process matches known log forwarder binaries (e.g., splunkd.exe, datadog-agent.exe) and the Destination Port is restricted to standard ingestion ports (443 or 8086),