URLhaus: 91-92-240-150 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving traffic to known malicious URLs associated with the specific threat signature 91-92-240-150, which often indicates active phishing or command-and-control communications. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of these high-severity indicators allows the SOC team to isolate compromised endpoints and block malicious network flows before lateral movement occurs.

IOC Summary

Threat: 91-92-240-150 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 91-92-240-150
let malicious_domains = dynamic(["91.92.240.150"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.240.150"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: 91-92-240-150 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment.

• Scenario: Scheduled Cloud Backup Agent Connectivity

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often maintain persistent connections to cloud storage gateways (e.g., AWS S3, Azure Blob) which may resolve to the IP 91.92.240.150 for metadata synchronization or API calls during nightly maintenance windows.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host Group (e.g., Backup-Server-Pool) and Process Name (vbm.exe or rubrik-agent). Additionally, filter by time of day to exclude alerts generated between 02:00 and 06:00 local time.

• Scenario: Automated Security Patch Deployment via WSUS/SCCM

  • Context: The Microsoft Endpoint Configuration Manager (MECM) or WSUS servers frequently download update manifests and binaries from upstream Microsoft content delivery networks. If the specific CDN node serving these updates resolves to 91.92.240.150, the detection logic will trigger during patch cycles.
  • Filter/Exclusion: Exclude traffic where the User Agent contains keywords like “Microsoft-Update” or “SCCM-Agent”. Alternatively, whitelist the specific URL path /update/metadata if the tool allows path-based filtering within the Hunt package configuration.

• Scenario: Third-Party SaaS Integration Webhooks (e.g., Salesforce/ServiceNow)

  • Context: Internal applications such as Salesforce or **