URLhaus: 141-98-11-207 Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the consumption of known malicious web resources associated with the specific threat signature 141-98-11-207, which often indicates active phishing campaigns or command-and-control communications. A proactive hunt is essential within Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before these high-severity threats can compromise sensitive data or exfiltrate credentials.

IOC Summary

Threat: 141-98-11-207 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 141-98-11-207
let malicious_domains = dynamic(["141.98.11.207"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["141.98.11.207"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3 specific false positive scenarios for the URLhaus: 141-98-11-207 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7) periodically probe external endpoints to verify SSL certificates and web server availability. These scanners often generate HTTP requests to known malicious IP ranges (like 141-98-11-207) as part of their baseline testing, triggering the rule despite no actual threat.
  • Suggested Filter/Exclusion: Create a suppression rule that excludes traffic where the Source Host belongs to the “Security Scanners” Active Directory group or matches specific static IP ranges (e.g., 10.50.20.x). Additionally, filter out requests where the User-Agent string contains keywords like “Nessus”, “Qualys”, or “Rapid7”.

• Scenario: Scheduled Software Update & Patching Jobs

  • Context: Enterprise endpoint management suites (e.g., Microsoft Intune, SCCM/MECM, or Jamf) run scheduled jobs during off-hours to download patches, definitions, and configuration updates. These agents frequently connect to upstream update servers that may share the 141-98-11-207 IP range for content delivery, generating legitimate traffic that mimics malicious URL access patterns.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 05:00 local time) for the rule when the source process is identified as ccmexec.exe (SCCM), `IntuneManagement