URLhaus: 95-164-53-193-5001 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving access to a specific cluster of 15 malicious URLs identified by URLhaus, which may indicate active phishing campaigns or command-and-control communication. The SOC team should proactively investigate these indicators in Azure Sentinel to rapidly identify compromised endpoints and prevent potential data exfiltration or malware propagation before broader impact occurs.

IOC Summary

Threat: 95-164-53-193-5001 Total URLs: 15 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 95-164-53-193-5001
let malicious_domains = dynamic(["95.164.53.193"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["95.164.53.193"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 95-164-53-193-5001 Malicious URLs detection rule:

• Scenario: Automated vulnerability scanning tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) performing daily external web crawls that hit the specific URL http://95.164.53.193/scan-agent as part of their asset discovery process.

  • Suggested Filter: Exclude traffic originating from known scanner IP ranges (e.g., Source_IP IN [10.20.1.0/24, 172.16.50.0/24]) where the User-Agent string contains keywords like “Nessus”, “Qualys”, or “Rapid7”.

• Scenario: Scheduled backup jobs initiated by Veeam Backup & Replication or Commvault that query a central management node hosted at 95.164.53.193 to retrieve configuration manifests before starting the nightly backup window.

  • Suggested Filter: Create an exclusion for traffic occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the source process name matches Veeam.Backup.Service.exe or commvault_agent.exe.

• Scenario: Enterprise Microsoft Intune or SCCM (Configuration Manager) clients performing a “Health Check” heartbeat to the cloud management service, which resolves to the IP 95.164.53.193 for policy synchronization and compliance reporting.

  • Suggested Filter: Exclude events where the destination URL path contains /healthcheck or /compliance-sync and the source device