URLhaus: 23-94-145-112 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based initial access or command-and-control channels by identifying traffic to known malicious URLs associated with the IP 23.94.145.112, which may indicate compromised endpoints or phishing landing pages. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage intrusions or lateral movement attempts before they escalate into significant data exfiltration or persistence activities.

IOC Summary

Threat: 23-94-145-112 Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 23-94-145-112
let malicious_domains = dynamic(["23.94.145.112"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["23.94.145.112"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom .NET or Java-based inventory system) may have hardcoded the IP 23-94-145-112 in its configuration file for a specific API endpoint or health check ping that was never updated after a network re-segmentation.
  • Filter/Exclusion: Exclude alerts where the source process is a known application server service (e.g., w3wp.exe, java.exe, or node.exe) and the destination port is standard HTTP/HTTPS (80/443), specifically if the user context is a service account rather than an interactive user.
• Scheduled Backup or Sync Jobs: An administrative scheduled task (e.g., Task Scheduler on Windows or cron on Linux) running a script to sync logs or backup data to a specific storage node that happens to resolve to or be accessed via 23-94-145-112 for a specific bucket or path.
  • Filter/Exclusion: Exclude alerts where the initiating process is a script interpreter (powershell.exe, cmd.exe, bash) spawned by a known scheduled task name (e.g., DailyLogSync, BackupAgent) and the command line contains specific keywords like backup, sync, or upload.
• Development or Staging Environment Testing: A developer or QA engineer on a staging network segment is manually testing a new integration feature by curling or using Postman to hit the 23-94-145-112 endpoint to verify connectivity before production deployment.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the designated Development/Staging VLAN (e.g., 10.20.0.0/24) and the user account name matches