URLhaus: 176-9-104-142 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based initial access or command-and-control channels by identifying traffic to known malicious URLs associated with the 176-9-104-142 tag, which adversaries often use to deliver payloads or exfiltrate data. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect compromised endpoints or lateral movement attempts before they escalate into a full breach, leveraging URL reputation data to surface hidden threats in network logs.

IOC Summary

Threat: 176-9-104-142 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 176-9-104-142
let malicious_domains = dynamic(["176.9.104.142"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.9.104.142"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., built on JSP or PHP) configured with a hardcoded external dependency or API endpoint that resolves to 176.9.104.142 for status pings or license validation.
  • Filter/Exclusion: Exclude source IPs belonging to the specific application server subnet (e.g., 10.20.5.0/24) or exclude the specific user agent string associated with the legacy app’s health check script (e.g., LegacyApp-HealthCheck/1.0).
• Scheduled Backup Verification Jobs: A nightly scheduled task (e.g., via cron on Linux or Task Scheduler on Windows) that runs a script to verify backup integrity by fetching a checksum or status file from a remote storage endpoint hosted at 176.9.104.142.
  • Filter/Exclusion: Exclude traffic where the destination port is 443 (HTTPS) and the source process is a known backup utility (e.g., veeamagent.exe, commvaultclient.exe, or python.exe running a specific backup script path).
• CI/CD Pipeline Dependency Fetching: A Jenkins or GitLab CI runner pulling a specific artifact, configuration file, or library version from a private artifact repository or CDN node that happens to be hosted on 176.9.104.142 during a build step.
  • Filter/Exclusion: Exclude source IPs within the CI/CD runner cluster range (e.g., 192.168.100.0/24) and correlate with active pipeline job IDs or exclude if the User-Agent contains Jenkins or GitLab-Runner.
• **Third-Party SaaS Integration Web