URLhaus: 95-155-151-113 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of seven specific malicious URLs identified by URLhaus under the tag 95-155-151-113, which often indicate active phishing campaigns or command-and-control communications. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly identify and isolate compromised endpoints before they facilitate data exfiltration or lateral movement across the network.

IOC Summary

Threat: 95-155-151-113 Total URLs: 7 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 95-155-151-113
let malicious_domains = dynamic(["95.155.151.113"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["95.155.151.113"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters for the URLhaus: 95-155-151-113 Malicious URLs detection rule:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query the URLhaus API to fetch the latest threat intelligence feeds before deploying updates. These scheduled jobs may trigger the rule when they access the specific IP 95-155-151-113 as part of their update verification process, even though no user interaction is occurring.
  • Suggested Filter: Exclude traffic where the source host belongs to the “Patch Management Servers” asset group and the destination port is restricted to standard API ports (e.g., 443) during off-hours (01:00–05:00).

• Scenario: Security Information and Event Management (SIEM) Enrichment

  • Context: The organization’s SIEM platform, such as Splunk Enterprise Security or IBM QRadar, runs a nightly enrichment job that queries external threat intelligence sources. If the rule logic does not distinguish between internal security tool traffic and user browsing, the SIEM’s own connection to 95-155-151-113 for data ingestion will generate an alert.
  • Suggested Filter: Create a rule exclusion based on source IP ranges assigned to the “Security Operations Center (SOC)” network segment, specifically filtering out traffic initiated by service accounts named svc-siem-enrichment.

• Scenario: Cloud Backup and Archiving Agents

  • Context: Cloud backup solutions like Veeam Backup & Replication or Rubrik often include a ”