URLhaus: 192-253-248-52 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious URLs associated with IP address 192.253.248.52, which are flagged by URLhaus as indicators of potential web-based threats or command-and-control infrastructure. The SOC team should proactively hunt for these specific URLs in Azure Sentinel to rapidly identify early-stage compromise events and mitigate risks before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Threat: 192-253-248-52 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-253-248-52
let malicious_domains = dynamic(["192.253.248.52"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.253.248.52"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 192-253-248-52 Malicious URLs detection rule, along with targeted filtering strategies:

• Scenario: Automated Security Tool Telemetry & Updates

  • Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or SentinelOne frequently initiate outbound connections to the IP 192.253.248.52 (often associated with URLhaus feeds) to download threat intelligence updates, signature definitions, or submit telemetry data.
  • Filter/Exclusion: Create a host-based exclusion for specific security agent processes. For example, exclude traffic generated by C:\Program Files\CrowdStrike\csfalcon.exe and C:\Windows\System32\MsMpEng.exe when the destination IP is 192.253.248-52.

• Scenario: Scheduled Cloud Backup & Synchronization Jobs

  • Context: Background services such as Veeam Backup & Replication, Rubrik, or Microsoft OneDrive for Business often utilize this IP range for metadata synchronization, policy downloads, or health checks during nightly maintenance windows (e.g., 02:00 – 04:00).
  • Filter/Exclusion: Implement a time-based exclusion window. Configure the rule to suppress alerts originating from backup service accounts (e.g., svc-veeam-backup) between 01:00 and 05:00 daily, or exclude specific scheduled task IDs known to trigger these connections.

• Scenario: Third-Party SaaS Integration & API Polling

  • Context: Business applications like Salesforce, ServiceNow, or **J