URLhaus: 195-177-94-162 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious web resources associated with the specific threat signature 195-177-94-162, which often indicates early-stage phishing or command-and-control activity. A SOC team should proactively investigate these URLs in Azure Sentinel to rapidly identify compromised endpoints and prevent potential lateral movement before the threat escalates into a broader incident.

IOC Summary

Threat: 195-177-94-162 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-162
let malicious_domains = dynamic(["195.177.94.162"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.162"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 195-177-94-162 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Cloud Backup Synchronization

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently initiate outbound connections to cloud storage endpoints (AWS S3, Azure Blob) that may resolve to the IP 195.177.94.162 during metadata synchronization or incremental data uploads. These scheduled jobs often trigger the rule due to high-volume URL requests from backup agents running on non-user workstations.
  • Suggested Filter: Create an exclusion based on the Source Host Name containing specific backup agent identifiers (e.g., *VeeamAgent*, *Rubrik-Worker*) and restrict the rule trigger to exclude traffic originating from the dedicated “Backup Infrastructure” VLAN or subnet.

• Scenario: Third-Party SaaS Integration Webhooks

  • Context: CRM platforms such as Salesforce or ERP systems like SAP SuccessFactors utilize webhooks to push real-time data updates to external analytics dashboards. The IP 195.177.94.162 may be a known endpoint for a specific middleware connector (e.g., an MuleSoft instance) handling these legitimate API callbacks, which the URLhaus feed has temporarily flagged as suspicious due to recent traffic pattern changes.
  • Suggested Filter: Implement a filter excluding URLs where the Destination Domain matches known SaaS provider domains (e.g., *.salesforce.com, *.successfactors.net) and restrict the alert severity for traffic originating from “Application Server” groups during business hours (08:00–18:00