URLhaus: 104-249-10-248 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious web resources associated with the specific threat signature 104-249-10-248 to prevent potential data exfiltration or malware delivery. The SOC team should proactively investigate these URLs in Azure Sentinel because they represent high-severity, emerging threats that may not yet be fully covered by existing static detection rules, requiring immediate validation of user and endpoint interactions.

IOC Summary

Threat: 104-249-10-248 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 104-249-10-248
let malicious_domains = dynamic(["104.249.10.248"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["104.249.10.248"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 104-249-10-248 Malicious URLs detection rule, including suggested filters and exclusions:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or OpenVAS) regularly probe external IP ranges to verify asset reachability. These tools often generate HTTP/HTTPS requests to known public IPs, including the specific range 104-249-10-248, which may be flagged as a “malicious URL” by URLhaus due to its reputation in other contexts.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., Host_Name contains 'Tenable') or Process Name (nessus.exe, qualyspcapd). Exclude traffic where the user agent string matches known scanner signatures (e.g., User-Agent contains 'Nessus').

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup perform scheduled synchronization tasks that connect to external storage endpoints. If the backup destination or a CDN node used by these services resolves to an IP within the 104-249-10-248 block, legitimate data transfer traffic will trigger the alert.
  • Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., Time between 02:00 and 06:00 UTC) combined with a process filter for backup executables (vbr.exe, azbackup). Alternatively, whitelist the specific destination URL path if it is static.

• **Scenario: Software Update Mechan