URLhaus: 150-40-127-145 Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the IP address 150.40.127.145 to host malicious URLs, a common tactic for delivering payloads or establishing command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets or active exfiltration attempts before they escalate into a full breach.

IOC Summary

Threat: 150-40-127-145 Total URLs: 17 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 150-40-127-145
let malicious_domains = dynamic(["150.40.127.145"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["150.40.127.145"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) uses a hardcoded health check script that periodically polls a specific endpoint on the 150-40-127-145 IP range to verify upstream dependency availability.

  • Filter/Exclusion: Exclude alerts where the source process is a known Java runtime (java.exe) or a specific service account (svc-legacy-app) and the destination port is 80 or 443.

• CI/CD Pipeline Dependency Fetching: A Jenkins or GitLab CI pipeline job downloads a specific shared library or configuration artifact hosted on the 150-40-127-145 IP during the build stage. The URL is whitelisted in the pipeline’s Jenkinsfile or .gitlab-ci.yml but not yet added to the global URL whitelist.

  • Filter/Exclusion: Exclude alerts where the source process is a CI agent (e.g., jenkins-agent.exe, gitlab-runner.exe) and the user context is a service account (e.g., svc-ci-pipeline).

• Scheduled Backup Verification Job: A PowerShell scheduled task (BackupVerify.ps1) runs daily at 02:00 AM to validate backup integrity by pinging a specific status endpoint on the 150-40-127-145 IP. This is a known administrative task documented in the runbook.

  • Filter/Exclusion: Exclude alerts where the source process is powershell.exe and the command line contains BackupVerify or the scheduled task name DailyBackupCheck.

• Third-Party SaaS Integration Webhook: A marketing automation platform (e.g., HubSpot or Marketo) sends webhook notifications to a callback URL hosted