URLhaus: 176-65-139-152 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based intrusion attempts by identifying traffic to a specific cluster of 16 malicious URLs associated with the IP 176.65.139.152, which adversaries may use for command-and-control, credential harvesting, or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect early-stage web interactions before they escalate into lateral movement or data exfiltration, leveraging high-severity intelligence to reduce dwell time.

IOC Summary

Threat: 176-65-139-152 Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-152
let malicious_domains = dynamic(["176.65.139.152"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.152"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Whitelisting: A legacy internal web application (e.g., a custom-built HR portal or inventory system) hosted on the IP 176.65.139.152 may be accessed by end-users or service accounts via direct IP connections rather than a resolved FQDN, triggering the URL match.
  • Filter/Exclusion: Exclude network traffic where the source IP belongs to the internal 10.0.0.0/8 range and the destination IP is 176.65.139.152, or specifically exclude the user agent string associated with the legacy app (e.g., LegacyHRApp/1.0).
• Scheduled Backup or Sync Jobs: A scheduled PowerShell or Python script (e.g., SyncData.ps1) running on a file server or database host may periodically pull configuration files or logs from a staging environment hosted at 176.65.139.152 using Invoke-WebRequest or curl.
  • Filter/Exclusion: Exclude events where the process name is powershell.exe or python.exe and the command line contains keywords like sync, backup, or config, and the source computer is in the FileServers or DBHosts AD security group.
• Development/Staging Environment Access: Developers or QA engineers accessing a staging instance of a microservice hosted on 176.65.139.152 for testing purposes, often via browser or API clients, without going through the corporate proxy or DNS resolution.
  • Filter/Exclusion: Exclude traffic from users in the DevTeam or QAEngineers AD group, or filter by source ports commonly used by development tools (e.g., `5432