URLhaus: 94-154-43-91 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving access to a specific cluster of 17 malicious URLs associated with the 94-154-43-91 threat signature, indicating potential command-and-control communication or phishing campaigns. Proactive hunting for these indicators within Azure Sentinel is critical due to their high severity rating, allowing the SOC team to rapidly isolate compromised endpoints and prevent lateral movement before broader network impact occurs.

IOC Summary

Threat: 94-154-43-91 Total URLs: 17 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-91
let malicious_domains = dynamic(["94.154.43.91"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.91"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 94-154-43-91 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically perform outbound connectivity checks against known threat intelligence feeds. These agents may query the specific IP range 94-154-43-91 to validate sensor health or retrieve updated signatures, triggering the rule despite no user interaction.
  • Filter/Exclusion: Create a network exclusion based on the source process name (e.g., C:\Program Files\CrowdStrike\fsfalcon.exe) and restrict the alert trigger to exclude traffic originating from the dedicated “Security Management” VLAN or specific host groups labeled “EDR-Infrastructure.”

• Scenario: Scheduled Cloud Backup and Sync Operations

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Microsoft OneDrive for Business often utilize cloud storage endpoints that share IP ranges with known threat intelligence providers. During nightly scheduled jobs (e.g., 02:00–04:00 UTC), these services initiate large data transfers to the 94-154-43-91 range, which the rule interprets as a malicious URL interaction.
  • Filter/Exclusion: Implement a time-based suppression policy that disables this specific detection rule between 02:00 and 06:00 UTC for all hosts within the “Backup-Servers” Active Directory group. Alternatively, whitelist the destination IP 94-154-43-91 specifically for traffic generated by the process `Vee