URLhaus: 45-83-31-84 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity where endpoints access known malicious URLs identified by URLhaus under the specific tag 45-83-31-84, indicating potential command-and-control communications or phishing attempts. A proactive search is critical in Azure Sentinel to immediately isolate affected resources and prevent lateral movement before these high-severity threats can compromise sensitive data or exfiltrate information.

IOC Summary

Threat: 45-83-31-84 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-83-31-84
let malicious_domains = dynamic(["45.83.31.84"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.83.31.84"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 45-83-31-84 Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Antivirus Endpoint Definition Updates

  • Scenario: The endpoint protection suite (e.g., Microsoft Defender Antivirus or CrowdStrike Falcon) initiates a daily scheduled job to download the latest virus definition signatures from the vendor’s update server. If the specific IP 45-83-31-84 is part of the vendor’s CDN network hosting these signature packages, legitimate downloads will trigger the rule despite being benign.
  • Filter/Exclusion: Create a detection exclusion for traffic originating from known internal AV management servers (e.g., *.update.microsoft.com, *.crowdstrike.com) or exclude specific scheduled tasks named “Antimalware Update” during their defined maintenance windows (e.g., 02:00–04:00 UTC).

• Cloud Backup and Synchronization Services

  • Scenario: Enterprise file synchronization tools like OneDrive for Business, Google Workspace Drive, or Dropbox Business perform background sync operations. These services often route traffic through a shared pool of IP addresses; if 45-83-31-84 is utilized by the backup provider’s storage gateway to fetch metadata or large binary files, legitimate user file uploads/downloads will generate false alerts.
  • Filter/Exclusion: Exclude traffic where the User-Agent string contains specific keywords (e.g., “OneDrive”, “Google Drive Sync”) and filter out URLs ending in known backup extensions like .backup, .sync, or .manifest when accessed by service accounts rather than interactive user sessions.

• Third-Party SaaS Analytics and Reporting

  • Scenario: Business Intelligence tools such as Tableau, Power