This hypothesis targets potential web-based intrusion attempts by identifying traffic to known malicious URLs associated with the IP 45.61.150.229 on port 8080, which may indicate compromised endpoints or active phishing campaigns. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to detect early-stage web attacks and isolate affected assets before lateral movement or data exfiltration occurs.
Threat: 45-61-150-229-8080 Total URLs: 3 Active URLs: 3
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://45.61.150.229:8080/pear.exe | online | malware_download | 2026-09-07 |
hxxp://45.61.150.229:8080/dlr.vbs | online | malware_download | 2026-09-07 |
hxxp://45.61.150.229:8080/dl.hta | online | malware_download | 2026-09-07 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-61-150-229-8080
let malicious_domains = dynamic(["45.61.150.229"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.61.150.229"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
45.61.150.229:8080 endpoint to verify upstream service availability. This is a known configuration quirk from a vendor migration.
App-Legacy-AppPool service account or filter out requests where the User-Agent string contains LegacyHealthCheck/1.0.Task Scheduler on a specific ETL server (ETL-Server-01) fetches reference data from a third-party API hosted at this IP for currency exchange rates.
ETL-Server-01 or filter out traffic where the destination port is 8080 and the source is within the ETL-Subnet VLAN, provided the connection is initiated by the svc-etl service account.nginx or HAProxy reverse proxy to forward certain API calls to 45.61.150.229:8080 for testing purposes during a feature branch deployment.
Dev-JumpHosts group or filter out traffic where the source port is ephemeral and the destination is 45.61.150.229:8080 if the source user is in the Dev-Team AD group and the time window is within business hours.