URLhaus: 195-177-94-25 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving communication with known malicious URLs associated with the IP address 195.177.94.25, which often indicates active threat intelligence feeds flagging potential command and control or phishing infrastructure. A SOC team should proactively hunt for this behavior in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistent access within the network.

IOC Summary

Threat: 195-177-94-25 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 195-177-94-25
let malicious_domains = dynamic(["195.177.94.25"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["195.177.94.25"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the URLhaus: 195-177-94-25 Malicious URLs detection rule:

• Scenario: Automated Cloud Backup Service Connectivity

  • Context: The enterprise uses Veeam Backup & Replication or Azure Backup Agent, which periodically connects to the IP 195.177.94.25 (often a CDN node for Microsoft or a specific SaaS provider) to download configuration updates, license keys, or backup metadata.
  • Filter/Exclusion: Create an exclusion rule in the EDR/SIEM logic that suppresses alerts where the Source Host is part of the “Backup Servers” AD Group and the Destination Port matches standard HTTPS (443) traffic initiated by the service account svc-veeam-agent.

• Scenario: Scheduled Software License Verification

  • Context: Adobe Creative Cloud or Autodesk AutoCAD installed on engineering workstations performs a daily scheduled task (Task Scheduler entry named “LicenseCheck”) to validate floating licenses against the vendor’s validation server hosted at this IP. This occurs during off-hours (e.g., 02:00 AM).
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:00 and 04:00 local time, specifically targeting processes named AdobeUpdateService.exe or AutodeskLicenseManager.exe communicating with the target IP.

• Scenario: Third-Party CRM Data Synchronization

  • Context: The organization’s Salesforce integration middleware (e.g., using MuleSoft or a custom Python script running via Ansible Tower) pushes nightly data syncs to an external partner portal hosted on the `19