URLhaus: 45-88-186-164-8000 Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where threat actors leverage specific malicious URLs identified by URLhaus to deliver payloads or facilitate command and control communications via port 8000. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify early-stage web-based compromises and prevent potential lateral movement or data exfiltration before they escalate into broader incidents.

IOC Summary

Threat: 45-88-186-164-8000 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 45-88-186-164-8000
let malicious_domains = dynamic(["45.88.186.164"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.88.186.164"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3–5 specific false positive scenarios for the URLhaus: 45-88-186-164-8000 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Management) periodically probe external endpoints to check for open ports or specific service availability. If the scanner is configured to test connectivity against a known public IP range that includes 45.88.186.164, it may generate HTTP requests to port 8000, triggering the rule even though the traffic is benign and expected.
  • Suggested Filter/Exclusion: Create an exclusion based on the source user agent string containing specific scanner identifiers (e.g., *Tenable.Nessus* or *QualysGuard*) OR exclude traffic originating from the dedicated IP subnets assigned to the vulnerability management team’s jump hosts.

• Scenario: Scheduled Cloud Backup & Sync Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup Agents often run scheduled jobs during off-hours that establish connections to external cloud storage gateways or verification services. If the target IP 45.88.186.164 on port 8000 is part of a vendor’s API endpoint used for status reporting or manifest uploads, these routine sync operations will generate legitimate traffic matching the detection logic.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 06:00 UTC) for processes named VeeamBackup.exe or `AzureStorageAgent