URLhaus: 192-142-53-225 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access malicious URLs associated with the IP address 192.142-53-225, indicating potential command-and-control communication or phishing delivery attempts. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate compromised systems before lateral movement or data exfiltration occurs.

IOC Summary

Threat: 192-142-53-225 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-142-53-225
let malicious_domains = dynamic(["192.142.53.225"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.142.53.225"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 192-142-53-225 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanner Probing

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently perform active reconnaissance by sending HTTP/HTTPS requests to known threat intelligence feeds, including the IP 192.142.53.225, to validate connectivity and fetch latest malware signatures.
  • Filter/Exclusion: Create an exclusion rule based on the source hostname or process name. Exclude traffic where Source Host matches *scanner-server-01* OR Process Name equals nessus.exe / qualyspcagent.exe.

• Scenario: Scheduled Cloud Backup & Sync Operations

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Microsoft Azure Backup) often utilize the IP range for off-site repository synchronization. The scheduled nightly job may trigger a connection to this specific URL/IP to verify repository health before initiating data transfer.
  • Filter/Exclusion: Implement a time-based exclusion combined with process filtering. Exclude alerts generated between 01:00 and 05:00 (local time) where the Process Name is VeeamTransportService.exe or rubrik-agent.exe.

• Scenario: Endpoint Protection Cloud Connectivity

  • Context: Modern EDR/XDR agents (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) maintain persistent connections to threat intelligence clouds. The specific IP `192.142.5