URLhaus: 31-42-176-91-5001 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving traffic to specific malicious URLs identified by URLhaus, which are likely indicators of phishing campaigns or command-and-control infrastructure associated with threat signature 31-42-176-91-5001. The SOC team should proactively investigate these connections in Azure Sentinel to identify early-stage compromises and prevent potential data exfiltration or lateral movement before broader impact occurs.

IOC Summary

Threat: 31-42-176-91-5001 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 31-42-176-91-5001
let malicious_domains = dynamic(["31.42.176.91"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.42.176.91"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 31-42-176-91-5001 Malicious URLs detection rule:

• Scenario: Scheduled Cloud Backup Agent Scans

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently initiate outbound connections to their cloud management portals and update servers. These agents often query dynamic URL endpoints that may be temporarily flagged by URLhaus due to shared IP ranges with known malicious actors, triggering the rule during nightly maintenance windows (e.g., 02:00–04:00 UTC).
  • Suggested Filter: Create an exclusion based on the Source Host (specifically backup server FQDNs like backup-srv-01.corp.local) combined with a Time Window constraint to exclude alerts generated between 02:00 and 06:00 daily.

• Scenario: Automated Software Update Mechanisms

  • Context: Critical endpoint security tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection run automated telemetry checks against their central update repositories. The specific URL pattern 31-42-176-91-5001 often corresponds to a sub-domain used by these vendors for policy distribution, which can be misidentified as malicious if the vendor’s IP range overlaps with the threat tag.
  • Suggested Filter: Implement an exclusion rule targeting specific Process Names (e.g., FalconSensor.exe, MsMpEng.exe) and filter out any URL requests containing known vendor domains (e.g., *.crowdstrike.com or *.microsoftonline.com).

• Scenario: Third-Party CRM/ERP Integration Webhooks