URLhaus: 176-123-9-22 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving the consumption of known malicious web resources identified by URLhaus under the tag 176-123-9-22, which often indicate initial access or command and control operations. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly identify compromised endpoints interacting with high-severity threats before they escalate into broader incidents.

IOC Summary

Threat: 176-123-9-22 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-123-9-22
let malicious_domains = dynamic(["176.123.9.22"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.123.9.22"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 176-123-9-22 Malicious URLs detection rule:

• Automated Security Scanner Traffic: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Manager) frequently probe external endpoints to verify certificate validity and reachability. These tools often generate GET requests against known malicious URL patterns during scheduled discovery cycles.

  • Suggested Filter: Exclude traffic originating from the specific IP ranges of your security scanning appliances (e.g., Source_IP IN [10.20.50.0/24]) where the User-Agent string contains “Tenable” or “Qualys”.

• Cloud Backup and Sync Agents: Enterprise file synchronization tools like Microsoft OneDrive for Business, Google Drive, or Dropbox often perform background health checks by contacting external status endpoints that may be flagged as suspicious due to high-volume traffic patterns.

  • Suggested Filter: Create an exclusion rule for processes named OneDrive.exe, GoogleUpdate.exe, and Dropbox.exe when the destination URL matches the specific hash pattern of the 176-123-9-22 tag, provided the request method is GET and no file download payload exceeds 50KB.

• Software Update Mechanisms: Legitimate enterprise applications (e.g., Adobe Creative Cloud, Zoom, or Office 365) utilize update servers that may be hosted on domains recently added to URLhaus lists due to shared infrastructure with compromised sites.

  • Suggested Filter: Whitelist the specific update server domains associated with your organization’s approved software catalog (e.g., *.update.microsoft.com, *.adobe.com) and filter out alerts where the HTTP status code is 200 OK and the connection duration is under 5 seconds