URLhaus: 77-83-39-20 Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific malicious infrastructure identified by URLhaus at IP 77.83.39.20 to deliver payloads that may evade standard signature-based detection. Proactive hunting for this indicator within Azure Sentinel is critical to identify early-stage lateral movement or initial access attempts before they escalate into broader compromise events.

IOC Summary

Threat: 77-83-39-20 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 77-83-39-20
let malicious_domains = dynamic(["77.83.39.20"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["77.83.39.20"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 77-83-39-20 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Enterprise security appliances (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently perform outbound connectivity checks to verify internet reachability. These agents often query the URLhaus API endpoint (https://urlhaus.abuse.ch/api/) or specific feed URLs hosted on IP 77-83-39-20 to validate their own threat intelligence feeds, triggering the rule even though the traffic is benign and expected.
  • Suggested Filter: Exclude network traffic where the source process name matches known security agents (e.g., falcon.sys, s1agent.exe, MsSenseBrokerUx.exe) AND the destination URL contains /api/ or /feed/.

• Scenario: Scheduled Patch Management and Software Updates

  • Context: During nightly maintenance windows, patch management tools like Microsoft System Center Configuration Manager (SCCM) or Jamf Pro initiate background updates. These tools often pull update manifests or download patches from upstream repositories that route through the 77-83-39-20 IP range for signature verification before distributing to endpoints, causing a spike in legitimate connections flagged as malicious.
  • Suggested Filter: Create an exclusion based on time-of-day (e.g., 01:00–05:00 local time) combined with specific service account identities (e.g., NT SERVICE\WUAUSERCONFIG or SYSTEM) and destination ports commonly used for updates (443, 80).

• **Scenario: Third-