URLhaus: 217-60-241-32 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving interactions with two specific malicious URLs identified by URLhaus, which are likely indicators of phishing campaigns or command-and-control communications. A SOC team should proactively investigate these signals in Azure Sentinel to rapidly identify compromised endpoints and prevent potential data exfiltration or lateral movement before the threat escalates.

IOC Summary

Threat: 217-60-241-32 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 217-60-241-32
let malicious_domains = dynamic(["217.60.241.32"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.60.241.32"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 217-60-241-32 Malicious URLs detection rule in an enterprise environment:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query URLhaus or similar threat intelligence feeds directly from the agent service to check local cache definitions. This often triggers a connection to the specific IP 217.60.241.32 (URLhaus API/Feed server) during scheduled morning update cycles, mimicking a user browsing a malicious site.
  • Suggested Filter: Exclude traffic originating from known Endpoint Protection Service accounts or processes (e.g., C:\Program Files\CrowdStrike\csagent.exe, MsMpEng.exe) where the destination port is 443 and the User-Agent string contains “CrowdStrike” or “Microsoft Defender”.

• Scheduled Threat Intelligence Feed Synchronization by SIEM/EDR

  • Scenario: The organization’s central Security Information and Event Management (SIEM) system (e.g., Splunk, SentinelOne) runs a nightly cron job to pull the latest URLhaus feed data. This scheduled task initiates an outbound HTTPS connection to 217.60.241.32 to ingest threat signatures, which the detection rule interprets as a potential user interaction with a malicious URL.
  • Suggested Filter: Create an exclusion for source IPs belonging to the SIEM management cluster (e.g., 10.50.20.10/32) and restrict the alert logic to only trigger if the connection duration is less than 60 seconds, assuming feed syncs are long-running or distinct from user browsing sessions.