This hunt detects adversary behavior involving the consumption of newly identified malicious web resources flagged by Censys within the URLhaus threat intelligence feed. A SOC team should proactively investigate these indicators in Azure Sentinel to rapidly identify potential initial access or command and control activities before they escalate into broader incidents.
Threat: censys Total URLs: 21 Active URLs: 7
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://43.201.225.240/pty4 | offline | malware_download | 2026-07-22 |
hxxp://95.179.224.131:8080/pty4 | offline | malware_download | 2026-07-22 |
hxxp://133.130.120.21/pty3 | online | malware_download | 2026-07-22 |
hxxp://107.175.91.154/pty4 | online | malware_download | 2026-07-22 |
hxxp://153.121.64.189/pty4 | online | malware_download | 2026-07-22 |
hxxp://133.130.120.21/pty4 | online | malware_download | 2026-07-22 |
hxxp://153.121.64.189/pty3 | online | malware_download | 2026-07-22 |
hxxp://158.101.170.110:8080/pty4 | online | malware_download | 2026-07-22 |
hxxp://128.140.127.91:8080/pty3 | offline | malware_download | 2026-07-22 |
hxxp://103.149.46.223/pty4 | offline | malware_download | 2026-07-22 |
hxxp://44.251.73.166/pty4 | offline | malware_download | 2026-07-22 |
hxxp://3.150.67.206/pty4 | offline | malware_download | 2026-07-22 |
hxxp://185.76.78.13:8080/pty3 | offline | malware_download | 2026-07-22 |
hxxp://54.241.21.243/pty4 | offline | malware_download | 2026-07-22 |
hxxp://43.201.225.240/pty3 | offline | malware_download | 2026-07-22 |
hxxp://54.204.84.214/pty4 | offline | malware_download | 2026-07-22 |
hxxp://128.140.127.91:8080/pty4 | offline | malware_download | 2026-07-22 |
hxxp://103.149.46.223/pty3 | offline | malware_download | 2026-07-22 |
hxxp://185.76.78.13:8080/pty4 | offline | malware_download | 2026-07-22 |
hxxp://95.179.224.131:8080/pty3 | offline | malware_download | 2026-07-22 |
hxxp://185.209.49.62/pty3 | online | malware_download | 2026-07-22 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: censys
let malicious_domains = dynamic(["153.121.64.189", "133.130.120.21", "158.101.170.110", "185.209.49.62", "107.175.91.154"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["153.121.64.189", "133.130.120.21", "158.101.170.110", "185.209.49.62", "107.175.91.154"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: censys Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:
Scenario: Scheduled Security Tool Updates via Vendor Repositories
*.crowdstrike.com, *.sentinelone.net). Additionally, filter out traffic originating from the specific service accounts used by these tools (e.g., svc-edr-update) during their known maintenance windows.Scenario: Automated Cloud Backup and Synchronization Jobs
VeeamBackupJob, OneDriveSync) running during off-hours (02:00–05:00). Implement a filter that allows URLs containing known backup vendor domains (e.g., *.veeam.com, *.rubrik.com) regardless of the Censys “malicious” tag.Scenario: Admin-Driven Patch Management and Software Deployment *