URLhaus: 45-135-193-113 Malicious URLs

Hunt Hypothesis

This hunt identifies potential compromise vectors by correlating internal traffic with a specific set of 12 malicious URLs associated with the IP address 45.135.193.113, which are frequently used for command-and-control or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect early-stage intrusions or lateral movement attempts before they escalate into a full breach.

IOC Summary

Threat: 45-135-193-113 Total URLs: 12 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-135-193-113
let malicious_domains = dynamic(["45.135.193.113"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.135.193.113"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) uses a hardcoded script to ping a specific status endpoint on the 45-135-193-113 domain for uptime monitoring. This occurs via a scheduled cron job or Windows Task Scheduler entry named AppHealthCheck.

  • Filter/Exclusion: Exclude alerts where the source process is java.exe or python.exe and the destination IP matches 45-135-193-113, provided the source user account is a service account (e.g., svc-app-monitor) rather than an interactive user.

• CI/CD Pipeline Dependency Fetching: The enterprise CI/CD pipeline (e.g., Jenkins or GitLab CI) pulls a specific open-source library or configuration file from a mirror hosted on the 45-135-193-113 domain. This happens during the build or test stage of a pipeline run, initiated by the jenkins-agent or gitlab-runner service.

  • Filter/Exclusion: Exclude alerts where the source process is java.exe (Jenkins) or runner.exe (GitLab) and the source user is a known CI/CD service account (e.g., ci-cd-service), and the URL path matches a known artifact directory (e.g., /libs/ or /configs/).

• Third-Party SaaS Integration Polling: An internal middleware service (e.g., MuleSoft or Apache Kafka Connect) polls a third-party SaaS API endpoint hosted on 45-135-193-113 for real-time data synchronization. This is a legitimate, high-frequency HTTPS request initiated by the mule or `