URLhaus: 2-29-25-224-8000 Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging known malicious URLs from the URLhaus feed to establish command-and-control channels or deliver payloads, often via phishing or drive-by downloads. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised assets and active threat actor activity before they can escalate privileges or exfiltrate data.

IOC Summary

Threat: 2-29-25-224-8000 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 2-29-25-224-8000
let malicious_domains = dynamic(["2.29.25.224"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["2.29.25.224"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A developer or DevOps engineer manually tests a new microservice endpoint or API gateway configuration that happens to be hosted on the same IP/Port combination (224.8000) as the malicious URL, using tools like curl, Postman, or PowerShell (Invoke-WebRequest).
  • Filter/Exclusion: Exclude alerts where the source user is part of the DevOps-Team or Platform-Engineering security group, and the destination port is 8000, provided the source IP is within the internal development subnet (e.g., 10.20.0.0/24).
• Scenario: An automated CI/CD pipeline job (e.g., Jenkins, GitHub Actions, or Azure DevOps) runs a smoke test or health check against a staging environment that shares the same network namespace or IP address as the malicious host, triggering outbound HTTP requests during build or deployment stages.
  • Filter/Exclusion: Exclude alerts originating from known CI/CD service accounts (e.g., svc-jenkins, gha-runner) or from source IPs within the dedicated CI/CD VLAN (e.g., 172.16.10.0/24) when the destination is a known staging IP range.
• Scenario: A legacy application or internal tool uses a hardcoded configuration file pointing to a shared test server or mock service on port 8000 for non-production data ingestion, which coincidentally matches the malicious URL’s host:port.
  • Filter/Exclusion: Exclude alerts for specific application service accounts (e.g., app-legacy-inventory) accessing the IP 224.8000 if the source process name is in the allowlist (e.g., java.exe, node.exe) and the user agent string contains