URLhaus: 176-65-139-139 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving traffic to a specific set of twelve malicious URLs associated with the IP address 176.65.139.139, which are known indicators of compromise for potential command and control or phishing operations. The SOC team should proactively hunt for these URLs in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before the adversary can establish a persistent foothold within the network.

IOC Summary

Threat: 176-65-139-139 Total URLs: 12 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-139
let malicious_domains = dynamic(["176.65.139.139"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.139"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding filters for the URLhaus: 176-65-139-139 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query external IP ranges to check for the latest security updates and vulnerability definitions. If the tool’s update server or a third-party repository is hosted on an infrastructure sharing the 176-65-139-139 range, legitimate scan traffic will trigger the rule.
  • Suggested Filter: Create an exclusion based on the Source Host (e.g., Host_Name contains "PATCH-SERVER-01") or filter by Process Name (msconfig.exe, IvantiAgent.exe) to exclude traffic originating from known patch management servers.

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Background services such as Veeam Backup & Replication, Rubrik, or Microsoft OneDrive for Business execute scheduled jobs during off-hours to sync data or verify cloud connectivity. These agents often maintain persistent connections to external storage nodes that may reside within the 176-65-139-139 IP block, generating high-volume HTTP/HTTPS traffic that mimics malicious URL patterns.
  • Suggested Filter: Implement a time-based exclusion for known backup windows (e.g., Time is between 02:00 and 06:00) combined with an exclusion on the User Account (User_Name contains "svc_backup") to ignore traffic from dedicated service accounts.

• Scenario: Third-Party Security Intelligence Feeds