URLhaus: 36-255-97-23 Malicious URLs

Hunt Hypothesis

This rule detects adversary behavior involving the access of known malicious web resources identified by URLhaus, specifically targeting threats associated with the signature 36-255-97-23. The SOC team should proactively hunt for these indicators in Azure Sentinel to identify potential initial access or command and control activities that could lead to data exfiltration or lateral movement within the network.

IOC Summary

Threat: 36-255-97-23 Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 36-255-97-23
let malicious_domains = dynamic(["36.255.97.23"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["36.255.97.23"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Scheduled automated backup jobs initiated by Veeam Backup & Replication or Commvault agents connecting to the cloud storage gateway at https://gateway.backup-cloud.com/api/v1/status. The URL structure matches the detection pattern for 36-255-97-23 due to similar path segments, triggering a false positive during nightly windows.

  • Filter/Exclusion: Create an exclusion rule in the EDR/SIEM platform to suppress alerts where the source process name contains VeeamAgent.exe or CommServe.exe and the destination URL domain is explicitly whitelisted as *.backup-cloud.com.

• Scenario: The IT Operations team utilizes a centralized patch management tool, specifically Ivanti Neurons for Patch Management, which queries the vendor’s update repository at https://updates.ivanti.com/feeds/latest.xml. This legitimate API call generates traffic that mimics the malicious URL signature defined in the 36-255-97-23 rule.

  • Filter/Exclusion: Implement a context-based filter to exclude alerts where the user account belongs to the IT_Operations group and the destination URL ends with .xml or .json, specifically targeting the domain updates.ivanti.com.

• Scenario: A recurring SQL Server maintenance job executes a PowerShell script that calls an external analytics service at https://analytics.enterprise-solutions.net/metrics/health-check. The script runs every 15 minutes via Task Scheduler, generating consistent network traffic that overlaps with the rule’s detection logic.

  • Filter/Exclusion: Add a suppression policy for the specific executable path C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn\sqlservr.exe when accessing URLs containing /metrics/health-check, provided the source IP is within the internal management subnet