URLhaus: 176-65-139-212 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving network traffic to a specific set of 13 malicious URLs associated with IP 176.65.139.212, which are known indicators of compromise for potential phishing or command-and-control activities. The SOC team should proactively hunt for this in Azure Sentinel to identify early-stage lateral movement or data exfiltration attempts that may have bypassed standard perimeter defenses due to the high severity and targeted nature of these malicious endpoints.

IOC Summary

Threat: 176-65-139-212 Total URLs: 13 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-65-139-212
let malicious_domains = dynamic(["176.65.139.212"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.212"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding filters/exclusions for the URLhaus: 176-65-139-212 Malicious URLs detection rule:

• Scenario: Enterprise Endpoint Protection Agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performing scheduled definition updates.

  • Context: The security agents frequently pull update manifests and payload files from the IP 176.65.139.212 during off-hours maintenance windows, which the rule flags as a malicious URL connection.
  • Filter/Exclusion: Create an exclusion for traffic originating from known security agent service accounts (e.g., svc-crowdstrike, DefenderSvc) or exclude specific destination ports used by these agents (typically 443) when the source IP is within the internal management subnet.

• Scenario: Automated Patch Management Systems (e.g., SCCM, Ivanti, PDQ Deploy) executing software deployment tasks.

  • Context: During nightly patch cycles, the distribution point servers connect to 176.65-139.212 to download installation packages or verify checksums for third-party applications (such as Adobe Creative Cloud or Java updates) hosted on that IP.
  • Filter/Exclusion: Exclude traffic where the User-Agent string contains specific identifiers like “SCCMClient,” “IvantiPatch,” or “PDQDeploy,” and restrict the exclusion to business hours (08:00–18:00 local time) if updates are scheduled then.

• Scenario: Cloud Backup Solutions (e.g., Veeam, Rubrik, Acronis Cyber Protect) initiating repository synchronization jobs.

  • Context: The backup infrastructure utilizes 176.65-139.212