URLhaus: 94-154-43-44 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving web traffic to a specific set of 17 malicious URLs flagged by URLhaus under the identifier 94-154-43-44, which often indicates early-stage reconnaissance or command-and-control communication. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent potential data exfiltration before lateral movement occurs across the network.

IOC Summary

Threat: 94-154-43-44 Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-44
let malicious_domains = dynamic(["94.154.43.44"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.44"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3–5 specific false positive scenarios and corresponding filters for the URLhaus: 94-154-43-44 Malicious URLs detection rule in a legitimate enterprise environment:

• Scheduled Cloud Backup Agent Scans

  • Scenario: Enterprise backup solutions (e.g., Veeam, Rubrik, or Commvault) periodically query the URLhaus API to update their internal threat intelligence feeds. The backup service account initiates an HTTP GET request to https://urlhaus-api.abuse.ch/v1/urls which matches the detection logic for the specific hash signature associated with 94-154-43-44, triggering a false alert during nightly maintenance windows.
  • Filter/Exclusion: Exclude traffic originating from the specific backup service account (e.g., svc_backup_agent) or restrict the rule to exclude requests targeting the known URLhaus API endpoint (urlhaus-api.abuse.ch) when the destination port is 443 and the user agent contains “Veeam” or “Rubrik”.

• Endpoint Security Policy Updates

  • Scenario: The organization’s Endpoint Detection and Response (EDR) platform, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, automatically downloads daily definition updates. These agents frequently fetch threat intelligence data from external repositories that include the 94-154-43-44 signature set. When the agent polls this specific URL to verify integrity, it generates a hit on the detection rule despite being a benign administrative task.
  • Filter/Exclusion: Create an exclusion for traffic where the source process name matches FalconSensor.exe or MsMpEng.exe and the destination domain is part of the trusted threat intelligence provider list (e.g., *.abuse.ch). Alternatively, whitelist the specific IP address