URLhaus: 91-92-42-50 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution or access of known malicious web resources identified by URLhaus, specifically those associated with the IP range 91.92.42.50 which may indicate active command-and-control communication or phishing campaigns. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly identify compromised endpoints and block lateral movement before attackers can establish persistence within the organization’s cloud infrastructure.

IOC Summary

Threat: 91-92-42-50 Total URLs: 12 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 91-92-42-50
let malicious_domains = dynamic(["91.92.42.50"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.42.50"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 91-92-42-50 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Automated Security Scanner Probing

  • Scenario: Internal vulnerability management tools (e.g., Qualys, Tenable Nessus, or Rapid7 InsightVM) periodically scan external endpoints. These scanners often resolve and request known malicious test URLs to validate their own threat intelligence feeds, triggering the rule when they hit the 91-92-42-50 IP range during routine discovery scans.
  • Filter/Exclusion: Create an exclusion based on the Source Host or Process Name. Exclude traffic originating from known scanner service accounts (e.g., svc_qualys_agent) or specific asset groups tagged as “Vulnerability Scanners.”

• Endpoint Protection Cloud Updates

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) perform scheduled background updates. These agents frequently connect to the 91-92-42-50 IP range to download signature definitions, threat intelligence feeds, or configuration patches from the vendor’s cloud infrastructure, which may be flagged as “Malicious” by URLhaus due to high-volume traffic patterns.
  • Filter/Exclusion: Implement a filter on the Process Name and Destination Port. Exclude connections initiated by specific EDR service executables (e.g., C:\Program Files\CrowdStrike\fsa.exe) communicating over standard update ports (443, 80) during defined maintenance windows.

• IT Admin Manual Verification & Troubleshooting

  • Scenario: Security Operations Center (