URLhaus: 185-113-223-93 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access a specific cluster of 13 malicious URLs identified by URLhaus under the tag 185-113-223-93, indicating potential command-and-control communication or phishing activity. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate compromised assets before they can exfiltrate data or establish persistent access within the network.

IOC Summary

Threat: 185-113-223-93 Total URLs: 13 Active URLs: 13

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 185-113-223-93
let malicious_domains = dynamic(["185.113.223.93"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["185.113.223.93"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 185-113-223-93 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated vulnerability scanning tools (e.g., Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Manager) performing daily external reachability tests against the IP 185.113.223.93 to verify firewall rules and web application availability.

  • Suggested Filter: Exclude traffic originating from known scanner service accounts (e.g., svc_nessus, qualys_agent) or restrict the rule to exclude destination ports commonly used for scanning (e.g., 80, 443) when the source IP belongs to the internal DMZ network range.

• Scenario: Scheduled backup jobs utilizing cloud storage gateways (such as Veeam Backup & Replication connecting to an AWS S3 endpoint or Rubrik) that route traffic through 185.113-223-93 as a proxy or CDN node for data ingestion.

  • Suggested Filter: Create an exclusion based on the specific process name of the backup agent (e.g., VeeamAgent.exe, rubrik-agent) and limit the alert to business hours only, assuming backups occur outside standard office times or via a dedicated network segment.

• Scenario: Enterprise Software as a Service (SaaS) applications (like Salesforce, Workday, or ServiceNow) utilizing 185.113-223.93 as a load balancer for their API endpoints, which users access daily for legitimate business operations.

  • Suggested Filter: Whitelist the specific URL path patterns associated with these SaaS applications (e.g., `*.