URLhaus: 194-150-166-178 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of specific malicious URLs identified by URLhaus (tagged 194-150-166-178), which often indicate early-stage phishing campaigns or command-and-control communications. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate compromised endpoints before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Threat: 194-150-166-178 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 194-150-166-178
let malicious_domains = dynamic(["194.150.166.178"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["194.150.166.178"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding filters for the URLhaus: 194-150-166-178 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Enterprise security platforms like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often perform periodic “heartbeat” checks or configuration syncs by connecting to known external update servers. If the IP 194.150.166.178 is a vendor endpoint used for these checks, the agent’s background process (e.g., falcon.sys, SentinelOneService.exe) will trigger this rule during routine maintenance windows.
  • Suggested Filter: Exclude traffic where the Source Process Name matches known security agents (*Falcon*, *SentinelOne*, *MsMpEng.exe) and the Destination Port is 443 (HTTPS) or 80, specifically when initiated during non-business hours (e.g., 02:00–05:00 local time).

• Scenario: Scheduled Patch Management & Software Updates

  • Context: Tools like Microsoft System Center Configuration Manager (SCCM) or WSUS often pull update manifests and binaries from external repositories. If the organization utilizes a specific third-party software vendor whose CDN resolves to 194.150.166.178, scheduled jobs running via Task Scheduler (e.g., “Update Agent Sync”) will generate legitimate connections that match the malicious URL signature.
  • Suggested Filter: Create an exclusion for Source Hosts belonging to the Patch-Management security group and filter by Scheduled Task Name containing keywords like “Update”, “Sync”, or