URLhaus: 94-154-32-185 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where threat actors leverage known malicious infrastructure (IP 94.154.32.185) to distribute phishing campaigns or command-and-control traffic via specific URLs identified by URLhaus. A SOC team should proactively hunt for this in Azure Sentinel because the high severity of these indicators suggests an active, targeted campaign that requires immediate investigation to prevent potential data exfiltration or lateral movement within the network.

IOC Summary

Threat: 94-154-32-185 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-185
let malicious_domains = dynamic(["94.154.32.185"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.185"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusions for the URLhaus: 94-154-32-185 Malicious URLs detection rule:

• Scenario: Automated Security Scanner Probing

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to verify connectivity and certificate validity. These tools often generate high-volume HTTP/HTTPS requests that match the URL signature of the 94-154-32-185 rule, even though they are benign discovery tasks rather than user-initiated browsing.
  • Suggested Filter: Create a host-based exclusion for known scanner IP ranges (e.g., Source_IP IN [10.20.5.0/24]) or filter events where the User-Agent string contains specific keywords like “Nessus”, “Qualys”, or “Rapid7”.

• Scenario: Scheduled Cloud Backup Agent Traffic

  • Context: Enterprise backup agents (such as Veeam, Rubrik, or Commvault) run scheduled jobs during off-hours to sync data with cloud repositories. These agents frequently access external S3 buckets or API endpoints that may share the same domain structure or IP reputation profile flagged by the URLhaus rule, triggering alerts on routine backup metadata exchanges.
  • Suggested Filter: Exclude traffic originating from specific service accounts (e.g., Source_User = "svc-backup-agent") during defined maintenance windows (e.g., 02:00–04:00 UTC) or filter by destination port if the rule is overly broad on standard backup ports like 9443.

• Scenario: Third-Party SaaS Integration Webhooks

  • Context: CRM and ERP