URLhaus: 195-177-94-141 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of known malicious URLs associated with IP 195.177.94.141, which often indicate active phishing campaigns or command-and-control communication. A SOC team should proactively search for these indicators in Azure Sentinel to identify early-stage compromises and prevent lateral movement before broader network impact occurs.

IOC Summary

Threat: 195-177-94-141 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-141
let malicious_domains = dynamic(["195.177.94.141"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.141"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding mitigation strategies for the URLhaus: 195-177-94-141 Malicious URLs detection rule:

• Scenario: Automated Software Update Scanners (e.g., WSUS, SCCM, or JFrog Artifactory)

  • Context: Enterprise patch management tools frequently query external repositories to check for the latest security patches. If the IP 195.177.94.141 hosts a legitimate update feed or metadata file used by these tools, the scanner’s background polling will trigger the alert every time it connects.
  • Filter/Exclusion: Create an exclusion based on the Source Host (e.g., Patch-Server-01, SCCM-Site-Server) and the specific Process Name (e.g., wsusclient.exe, ccmexec.exe). Alternatively, whitelist the destination URL path if it matches a known update feed pattern.

• Scenario: Scheduled Cloud Backup or Archiving Jobs

  • Context: Automated backup agents (such as Veeam, Rubrik, or Commvault) often connect to cloud storage endpoints or external logging services during off-hours. If 195.177.94.141 is part of the infrastructure for a specific SaaS backup provider or an external log aggregation service, scheduled jobs will generate traffic that mimics malicious URL access.
  • Filter/Exclusion: Implement a time-based filter to exclude alerts occurring during known maintenance windows (e.g., 02:00–04:00 UTC) for specific User Accounts associated with backup services (e.g., svc-backup-agent). Additionally, add the destination URL to the “Trusted URLs” list in the detection logic.