URLhaus: 124-198-131-91 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the utilization of specific malicious URLs (tagged 124-198-131-91) that are likely being leveraged for command and control or initial phishing campaigns to compromise endpoints. Proactive hunting in Azure Sentinel is critical because these high-severity indicators may represent a targeted threat requiring immediate investigation to prevent data exfiltration or lateral movement before broader impact occurs.

IOC Summary

Threat: 124-198-131-91 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 124-198-131-91
let malicious_domains = dynamic(["124.198.131.91"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["124.198.131.91"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 124-198-131-91 Malicious URLs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Automated Patch Management Scans

  • Scenario: The enterprise utilizes Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons to perform nightly vulnerability assessments. These agents frequently query the IP 124-198-131-91 (which may be a cloud-based threat intelligence feed or a specific vendor update server) to download patch manifests and security signatures, triggering the rule despite being a trusted administrative task.
  • Filter/Exclusion: Create a detection filter excluding network traffic where the Source Host Name matches known SCCM/Ivanti agent identities (e.g., SCCM-Agent-*) or restricts the rule to exclude URLs containing specific vendor paths like /updates/signatures.

• Cloud Backup and Archiving Services

  • Scenario: The organization employs Veeam Backup & Replication or Rubrik for daily data archiving. These services establish persistent connections to external cloud storage nodes, including 124-198-131-91, to verify checksums and upload incremental backup blocks. This legitimate high-volume traffic is misidentified as a malicious URL interaction by the detection logic.
  • Filter/Exclusion: Implement an exclusion based on the Destination Port (e.g., 443 for HTTPS) combined with a whitelist of known backup service accounts (e.g., Veeam-Service-Account). Alternatively, exclude traffic originating from the dedicated “Backup Subnet” IP range.

• Third-Party SIEM and Log Aggregation

  • Scenario: The