URLhaus: 193-26-115-28 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving connections to specific malicious URLs (tagged 193-26-115-28) that may indicate initial access or command-and-control communications from compromised hosts. Proactively hunting for these indicators in Azure Sentinel is critical due to the high severity of the threat, allowing the SOC team to rapidly isolate affected systems and prevent potential data exfiltration or lateral movement before broader impact occurs.

IOC Summary

Threat: 193-26-115-28 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 193-26-115-28
let malicious_domains = dynamic(["193.26.115.28"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["193.26.115.28"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding mitigation strategies for the URLhaus: 193-26-115-28 Malicious URLs detection rule in a legitimate enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, perform periodic outbound connectivity checks to the URLhaus API or internal threat intelligence feeds. These agents often initiate HTTP/HTTPS requests to 193.26.115.28 (or its associated subdomains) to fetch the latest malware signature updates, which triggers the rule despite being a trusted source.
  • Filter/Exclusion: Create an exclusion based on the Process Name and User Account. Exclude alerts where ProcessName matches C:\Program Files\CrowdStrike\csagent.exe (or equivalent EDR binary) and UserName is SYSTEM or a dedicated service account like svc-threat-intel.

• Scenario: Scheduled Cloud Backup Connectivity Checks

  • Context: Enterprise backup solutions, such as Veeam Backup & Replication or Commvault, execute scheduled jobs (e.g., daily at 02:00 AM) to verify network reachability and validate storage gateway health. These tools often ping specific IP ranges used by cloud providers or threat intelligence hubs, including the 193.26.115.28 range, resulting in legitimate traffic that mimics malicious URL access patterns.
  • Filter/Exclusion: Implement a time-based exclusion combined with a Process Path filter. Exclude events occurring between 01:00 and 04:00 where the ProcessPath contains `\Veeam\BackupService.exe