URLhaus: 85-11-167-178 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving initial access or command-and-control communications through a specific cluster of 17 known malicious URLs associated with IP 85-11-167-178. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage infections and prevent lateral movement before the threat escalates into a broader compromise.

IOC Summary

Threat: 85-11-167-178 Total URLs: 17 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 85-11-167-178
let malicious_domains = dynamic(["85.11.167.178"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["85.11.167.178"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 85-11-167-178 Malicious URLs detection rule, tailored for an enterprise environment:

• Automated Security Scanner Health Checks

  • Scenario: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to validate SSL certificates and service availability. If the scanner’s agent or management server is configured to reach out to a specific update repository hosted on 85-11-167-178 (or a subdomain thereof) for signature updates, this traffic may be flagged as malicious despite being part of a scheduled maintenance window.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Source IP of the scanner management server and the specific User-Agent string containing identifiers like Tenable.Nessus or QualysAgent. Alternatively, exclude traffic occurring during defined maintenance windows (e.g., 02:00–04:00 UTC daily).

• Software Deployment & Patch Management Agents

  • Scenario: Enterprise patch management tools such as Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Jamf Pro frequently download software bundles, drivers, and hotfixes from vendor repositories. If the organization has whitelisted a specific content delivery network (CDN) node with IP 85-11-167-178 for distributing these payloads, legitimate bulk downloads by thousands of endpoints during patch cycles will trigger this rule.
  • Suggested Filter/Exclusion: Exclude traffic where the Destination URL path contains known deployment keywords (e.g., /updates, /packages, /deploy) and the Source Host Group matches ”