This detection identifies adversary activity involving traffic to a curated set of 42 Censys-tagged malicious URLs that are known indicators of compromise. Proactive hunting in Azure Sentinel is essential because these high-severity signals often represent early-stage reconnaissance or command-and-control channels that may not yet trigger standard alerting thresholds, allowing the SOC team to intercept threats before lateral movement occurs.
Threat: censys Total URLs: 42 Active URLs: 38
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://120.46.15.254/pty10 | online | malware_download | 2026-07-28 |
hxxp://34.88.165.144:8080/pty3 | online | malware_download | 2026-07-28 |
hxxp://159.112.183.71:8080/pty10 | offline | malware_download | 2026-07-28 |
hxxp://113.45.17.8/pty3 | online | malware_download | 2026-07-28 |
hxxp://116.205.168.247/pty4 | online | malware_download | 2026-07-28 |
hxxp://1.95.51.146/pty4 | online | malware_download | 2026-07-28 |
hxxp://114.132.77.127:8080/pty3 | online | malware_download | 2026-07-28 |
hxxp://113.45.17.8/pty4 | online | malware_download | 2026-07-28 |
hxxp://1.94.221.183/pty4 | online | malware_download | 2026-07-28 |
hxxp://1.94.221.183/pty3 | online | malware_download | 2026-07-28 |
hxxp://120.46.12.14/pty3 | online | malware_download | 2026-07-28 |
hxxp://1.92.136.152/pty10 | online | malware_download | 2026-07-28 |
hxxp://123.249.20.250/pty4 | online | malware_download | 2026-07-28 |
hxxp://1.92.136.152/pty4 | online | malware_download | 2026-07-28 |
hxxp://120.46.12.14/pty10 | online | malware_download | 2026-07-28 |
hxxp://1.94.221.183/pty10 | online | malware_download | 2026-07-28 |
hxxp://113.45.17.8/pty10 | online | malware_download | 2026-07-28 |
hxxp://82.156.56.214:8080/pty10 | online | malware_download | 2026-07-28 |
hxxp://34.88.165.144:8080/pty10 | online | malware_download | 2026-07-28 |
hxxp://116.205.168.247/pty10 | online | malware_download | 2026-07-28 |
hxxp://120.46.15.254/pty3 | online | malware_download | 2026-07-28 |
hxxp://116.205.168.247/pty3 | online | malware_download | 2026-07-28 |
hxxp://1.95.51.146/pty3 | online | malware_download | 2026-07-28 |
hxxp://114.132.77.127:8080/pty4 | online | malware_download | 2026-07-28 |
hxxp://123.249.20.250/pty10 | online | malware_download | 2026-07-28 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: censys
let malicious_domains = dynamic(["1.95.51.146", "120.46.15.254", "82.156.56.214", "1.94.221.183", "120.46.12.14", "159.112.183.71", "1.92.136.152", "139.159.233.200", "34.88.165.144", "113.45.17.8", "114.132.77.127", "123.249.20.250", "116.205.168.247"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["1.95.51.146", "120.46.15.254", "82.156.56.214", "1.94.221.183", "120.46.12.14", "159.112.183.71", "1.92.136.152", "139.159.233.200", "34.88.165.144", "113.45.17.8", "114.132.77.127", "123.249.20.250", "116.205.168.247"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: censys Malicious URLs rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Automated Vulnerability Scanning by Internal Tools
Host_Name contains 'Nessus-Scanner') or specific Process Names (process_name in ['nessus.exe', 'qualyspc.exe']). Additionally, exclude traffic originating from dedicated scanning subnets (e.g., 10.50.20.0/24).Scenario: Scheduled Software Update and Patching Jobs
*.update.microsoft.com, *.download.windows.net) or filter based on specific Scheduled Task Names (e.g., Task_Name contains 'WSUS' or process_name == 'wuauclt.exe').Scenario: Cloud Backup and Synchronization Agents