URLhaus: 195-177-94-107 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving specific malicious URLs associated with the IP address 195.177.94.107, which are likely indicators of active phishing campaigns or command-and-control infrastructure. The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly isolate compromised endpoints and prevent potential data exfiltration before broader network impact occurs.

IOC Summary

Threat: 195-177-94-107 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-107
let malicious_domains = dynamic(["195.177.94.107"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.107"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 195-177-94-107 Malicious URLs detection rule:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons) frequently initiate outbound connections to the IP 195.177.94.107 during scheduled maintenance windows to download update manifests and security definitions.
  • Suggested Filter: Create an exclusion for traffic originating from known patch management service accounts (e.g., svc_sccm_update) or specific hostnames ending in .patch.local, restricting the rule trigger to non-scheduled hours (e.g., exclude 02:00–04:00 UTC).

• Scenario: Cloud Backup and Archiving Syncs

  • Context: Scheduled backup agents from tools like Veeam Backup & Replication or Rubrik connect to the detection IP as part of a cloud repository synchronization process, which may be categorized as “malicious” by URLhaus due to high-volume data transfer patterns resembling exfiltration.
  • Suggested Filter: Implement a rule exclusion based on the destination port (e.g., 443) and source application name (VeeamAgent.exe or RubrikSyncService), ensuring that only traffic from backup subnets (e.g., 10.20.50.x/24) is excluded.

• Scenario: Third-Party Security Intelligence Feeds

  • Context: Internal security information and event management (SIEM) systems or threat intelligence platforms like Splunk Enterprise Security or Tenable.io periodically query `195.177.