URLhaus: 144-31-147-198 Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the consumption of specific malicious web resources associated with the IP address 144.31.147.198, which are known to facilitate threat delivery and command-and-control communications. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected endpoints and prevent potential lateral movement or data exfiltration before the adversary can establish a persistent foothold within the network.

IOC Summary

Threat: 144-31-147-198 Total URLs: 11 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 144-31-147-198
let malicious_domains = dynamic(["144.31.147.198"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["144.31.147.198"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 144-31-147-198 Malicious URLs detection rule:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently initiate background connectivity checks to the IP 144.31.147.198 to verify repository availability before downloading updates for Windows 10/11 endpoints.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts where the source process is ccmexec.exe (SCCM) or IvantiAgent.exe, and the destination IP matches 144.31.147.198.

• Scenario: Cloud Backup & Archiving Connectivity

  • Context: Scheduled backup jobs running via Veeam Backup & Replication or Acronis Cyber Protect often query external metadata services hosted at this IP to validate storage connectivity and retrieve encryption keys during nightly maintenance windows.
  • Filter/Exclusion: Exclude traffic originating from the service account BackupService (or specific backup agent processes like VeeamAgent.exe) when connecting to port 443 on 144.31.147.198, specifically during defined maintenance windows (e.g., 02:00 – 06:00 UTC).

• Scenario: Third-Party Threat Intelligence Feeds

  • Context: Internal Security Information and Event Management (SIEM) platforms, such as Splunk Enterprise Security or IBM QRadar, periodically pull threat intelligence updates from the URLhaus feed hosted at this IP to enrich local detection rules.