URLhaus: 103-77-246-150 Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the consumption of malicious URLs hosted on IP 103.77.246.150, which are known to deliver malware payloads capable of compromising endpoint integrity. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly isolate affected assets and prevent lateral movement before the malware establishes persistence or exfiltrates sensitive data.

IOC Summary

Threat: 103-77-246-150 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 103-77-246-150
let malicious_domains = dynamic(["103.77.246.150"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.77.246.150"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 103-77-246-150 Malicious URLs detection rule, along with targeted filtering strategies:

• Scheduled Antivirus Definition Updates via Microsoft Endpoint Manager (Intune)

  • Scenario: The Intune agent on a domain-joined workstation initiates a background task to download the latest virus definition database from the vendor’s update server. This traffic often originates from internal IP ranges but targets external endpoints that may be flagged by URLhaus as “suspicious” due to high-volume data transfer patterns resembling C2 beaconing.
  • Filter/Exclusion: Create a whitelist rule excluding traffic where the User-Agent contains Microsoft-Defender-Antivirus or IntuneManagementExtension, and restrict the source IP range to the internal corporate subnet (e.g., 10.0.0.0/8).

• Automated Cloud Backup Jobs Using Veeam Backup & Replication

  • Scenario: A nightly scheduled job runs on a backup server to upload incremental snapshots to an offsite cloud repository. The destination URL for the API endpoint might be hosted on a shared infrastructure IP (103-77-246-150) that is currently flagged by URLhaus, causing the rule to trigger during the high-throughput transfer window between 02:00 and 04:00 UTC.
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:30 and 05:00 on weekdays, specifically when the destination port is 443 and the process name matches Veeam.Backup.Service.exe.

• Third-Party CRM Integration Webhooks (Salesforce/ServiceNow)

  • Scenario: The enterprise