URLhaus: 185-242-3-87 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of specific malicious web resources identified by URLhaus under tag 185-242-3-87, which often indicate early-stage phishing or command-and-control communications. A SOC team should proactively search for these URLs in Azure Sentinel to rapidly identify and isolate potential compromise vectors before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Threat: 185-242-3-87 Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 185-242-3-87
let malicious_domains = dynamic(["185.242.3.87"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["185.242.3.87"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 185-242-3-87 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query external repositories to download update manifests. These tools often access dynamic URLs that may be newly registered or shared across multiple vendors, triggering the rule if the specific IP/URL combination matches the 185-242-3-87 signature during a scheduled maintenance window.
  • Filter/Exclusion: Create an exclusion for traffic originating from the SCCM service account (e.g., NT AUTHORITY\SYSTEM) or specific hostnames ending in .configmgr.microsoft.com. Additionally, filter out alerts occurring strictly between 02:00 and 05:00 local time on weekdays to align with maintenance windows.

• Scenario: Cloud Backup Agent Connectivity

  • Context: Agents for cloud backup solutions such as Veeam Backup & Replication or Rubrik periodically contact their management servers or S3-compatible storage endpoints to verify connectivity and sync metadata. If the 185-242-3-87 signature encompasses a generic API endpoint used by these vendors, legitimate heartbeat checks will generate false positives.
  • Filter/Exclusion: Exclude traffic from known backup service accounts (e.g., VEEAM-SERVICE or Rubrik-Agent) and filter URLs containing specific backup domains like .veeam.com, .rubrik.com, or the organization’s dedicated S3 bucket endpoint.

• Scenario: Third-Party Threat Intelligence Feeds

  • Context: Security