URLhaus: 94-154-32-228 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior involving communication with known malicious infrastructure associated with the IP address 94-154-32-228, as flagged by URLhaus. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly isolate potential initial access or command-and-control channels before they facilitate data exfiltration or lateral movement within the network.

IOC Summary

Threat: 94-154-32-228 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-228
let malicious_domains = dynamic(["94.154.32.228"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.228"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 94-154-32-228 Malicious URLs detection rule, including targeted filters and exclusions:

• Automated Security Scanner Traffic: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to verify certificate validity or service availability. These scanners often generate HTTP/HTTPS requests to known IP ranges, which may include 94-154-32-228 if it is part of a public CDN or API gateway being tested.

  • Filter/Exclusion: Exclude traffic originating from the specific hostnames of your internal scanner appliances (e.g., scanner-prod-01, qualys-scan-node) or filter by the source IP range assigned to the Security Operations Center (SOC) infrastructure.

• Scheduled Cloud Backup and Sync Jobs: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup often perform scheduled connectivity checks against external storage nodes or update servers. If 94-154-32-228 hosts a repository or update feed, the nightly sync jobs (running via Task Scheduler on Windows Server or cron on Linux) will trigger this rule during their execution window.

  • Filter/Exclusion: Create an exclusion based on the specific process names of the backup agents (e.g., VeeamService.exe, rubrik-agent) and restrict the detection to business hours only, excluding the typical maintenance window (e.g., 02:00–04:00 UTC).

• Software Update Mechanisms: Endpoint management platforms such as Microsoft Intune, Jamf Pro, or SCCM regularly contact update servers to download patches or configuration