URLhaus: 64-89-163-22 Malicious URLs

Hunt Hypothesis

This detection rule identifies potential adversary activity involving reconnaissance or command-and-control communications through three specific malicious URLs associated with IP address 64.89.163.22. A proactive hunt in Azure Sentinel is essential to verify if these external connections represent legitimate traffic or an early-stage intrusion, allowing the SOC team to isolate affected endpoints before lateral movement occurs.

IOC Summary

Threat: 64-89-163-22 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 64-89-163-22
let malicious_domains = dynamic(["64.89.163.22"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["64.89.163.22"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 64-89-163-22 Malicious URLs detection rule, including tailored filters and exclusions:

• Scheduled Backup Agent Connectivity: The enterprise backup solution (e.g., Veeam Backup & Replication) runs a nightly job at 02:00 AM that queries the URLhaus API endpoint hosted on 64.89.163.22 to fetch the latest threat intelligence feeds for policy updates.

  • Filter/Exclusion: Create an exclusion rule targeting the specific service account (e.g., svc-veeam-backup) and the source IP range of the backup server, limiting the scope to the scheduled window between 01:45 AM and 02:30 AM.

• Cloud Security Posture Management Scans: The cloud security platform (Tenable One or Qualys Cloud Agent) performs automated daily vulnerability scans that include a reachability check against known threat intelligence hubs, triggering a request to the 64-89.163.22 IP to validate certificate chains and feed freshness.

  • Filter/Exclusion: Exclude traffic from the Tenable/Qualys management server’s FQDN (e.g., qualys-scan.corp.local) or specific process names (tenable-agent.exe, qualys-cloud-agent.exe) regardless of time, as this connectivity is a standard operational requirement.

• Endpoint Detection and Response (EDR) Telemetry: The EDR solution (CrowdStrike Falcon or Microsoft Defender for Endpoint) pushes real-time telemetry data to the URLhaus integration module hosted at 64.89.163.22 to correlate local alerts with global threat signatures, causing frequent outbound connections from all managed endpoints. *