URLhaus: 104-249-10-175 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the execution or access of specific malicious URLs flagged by URLhaus, which often serve as initial entry points for phishing campaigns or malware distribution. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 104-249-10-175 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 104-249-10-175
let malicious_domains = dynamic(["104.249.10.175"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["104.249.10.175"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 104-249-10-175 Malicious URLs detection rule in a legitimate enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to verify certificate validity and service availability. These scanners often generate HTTP/HTTPS requests that match the signature of the 104-249-10-175 tag, particularly when scanning public-facing web servers.
  • Filter/Exclusion: Create a detection rule exception based on the Source IP of the scanner management server or the specific Process Name (e.g., nessus.exe, qualyspc.exe). Alternatively, filter out traffic where the User-Agent string contains “Tenable,” “Qualys,” or “Rapid7.”

• Scenario: Scheduled Patch Management Updates

  • Context: Enterprise patch management solutions like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons periodically connect to vendor update repositories to download metadata and manifests. If the rule logic flags specific URLs used by these vendors for manifest retrieval, legitimate scheduled jobs running during business hours will trigger alerts.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., exclude detections between 02:00 and 06:00 local time) or add an exclusion for the specific Destination URL domain known to host these manifests (e.g., *.update.microsoft.com or *.ivanti.com) if they align with the 104-249-10-175 tag.

• **Scenario: Cloud Backup