URLhaus: 152-42-202-172 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious web resources associated with the specific threat signature 152-42-202-172, which often indicates early-stage command and control or phishing activities. A SOC team should proactively hunt for these URLs in Azure Sentinel to rapidly isolate compromised endpoints before attackers can establish persistence or exfiltrate sensitive data through these high-severity entry points.

IOC Summary

Threat: 152-42-202-172 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 152-42-202-172
let malicious_domains = dynamic(["152.42.202.172"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["152.42.202.172"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 152-42-202-172 Malicious URLs detection rule, along with targeted filters and exclusions suitable for a legitimate enterprise environment:

• Scenario: Automated Security Feed Ingestion by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically poll the URLhaus API to update their local threat intelligence feeds. These agents often initiate outbound HTTPS connections directly to 152-42-202-172 to fetch daily malware hash lists and URL signatures.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts for traffic originating from the specific service accounts or process names of the EDR agents (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or MsMpEng.exe) when the destination IP is 152.42.202.172.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often include a “Threat Intelligence Check” step in their nightly scheduled jobs. These jobs connect to the URLhaus infrastructure to verify that backup repositories are not communicating with known malicious endpoints before finalizing the archive, triggering the rule during the window of 02:00–04:00 AM.
  • Filter/Exclusion: Implement a time-based exclusion filter for the specific backup service accounts (e.g., svc-veeam-backup) running between 01:30 and 05:00 daily, restricting the scope to the source subnet of the backup servers (e.g., `1