URLhaus: 195-177-94-240 Malicious URLs

Hunt Hypothesis

This hunt hypothesis detects adversary behavior involving the consumption of known malicious web resources associated with the specific threat signature 195-177-94-240, which often indicates active phishing campaigns or command-and-control communication. A SOC team should proactively hunt for these URLs in Azure Sentinel to identify early-stage lateral movement or data exfiltration attempts before they escalate into full-scale incidents within the organization’s network perimeter.

IOC Summary

Threat: 195-177-94-240 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-240
let malicious_domains = dynamic(["195.177.94.240"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.240"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 195-177-94-240 Malicious URLs detection rule:

• Scenario: Automated vulnerability scanning tools (e.g., Tenable Nessus, Qualys, or OpenVAS) performing external web crawls.

  • Context: These scanners frequently probe known malicious infrastructure to validate threat intelligence feeds or test firewall rules, generating legitimate traffic to the IP 195-177-94-240 without indicating an actual compromise of internal endpoints.
  • Filter/Exclusion: Exclude network traffic originating from specific scanner subnets (e.g., 10.10.50.0/24) or filter alerts where the source device type is identified as “Security Scanner” in the asset inventory.

• Scenario: Scheduled EDR/Antivirus definition updates initiated by Microsoft Defender for Endpoint or CrowdStrike Falcon agents.

  • Context: During nightly maintenance windows, endpoint agents often reach out to cloud-based threat intelligence repositories hosted on this IP to fetch the latest URL reputation signatures and malware definitions.
  • Filter/Exclusion: Create a time-based exclusion rule that suppresses alerts between 01:00 and 04:00 UTC for processes named MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) when the destination URL matches the specific hash associated with this IP.

• Scenario: Legitimate third-party SaaS integrations used by the Finance department (e.g., SAP Concur, Workday, or Salesforce).

  • Context: Business applications often embed external widgets or API calls that route traffic through shared CDNs or partner gateways hosted on this IP address for secure document exchange and reporting.