URLhaus: 94-154-32-180 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of newly identified malicious URLs from the URLhaus threat intelligence feed, specifically targeting indicators associated with the 94-154-32-180 signature to identify potential phishing or command-and-control activity. A SOC team should proactively hunt for these high-severity signals in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish a persistent foothold within the network.

IOC Summary

Threat: 94-154-32-180 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-180
let malicious_domains = dynamic(["94.154.32.180"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.180"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 94-154-32-180 Malicious URLs detection rule, along with recommended filters or exclusions:

• Automated Threat Intelligence Feed Ingestion by SIEM

  • Scenario: The enterprise Security Information and Event Management (SIEM) system (e.g., Splunk Enterprise Security or Microsoft Sentinel) is configured to pull daily updates from the URLhaus API. During these scheduled ingestion jobs, the SIEM engine itself initiates HTTP GET requests to 94-154-32-180 to fetch the latest threat feed data, triggering a self-detection.
  • Filter/Exclusion: Exclude traffic where the Source Host is identified as the SIEM server (e.g., host_name = "siem-collector-01") or filter by Process Name matching the ingestion service (e.g., process_name = "splunkd.exe").

• Endpoint Protection Cloud Updates via Microsoft Defender for Endpoint

  • Scenario: The organization uses Microsoft Defender for Endpoint. During its scheduled cloud update cycle, the Defender client contacts the URLhaus infrastructure to download the latest signature definitions and reputation data. If 94-154-32-180 is part of the Microsoft content delivery network or a trusted partner node, the endpoint’s background service generates legitimate traffic that mimics malicious behavior.
  • Filter/Exclusion: Create an exclusion rule for the Process Name MsMpEng.exe (Microsoft Antimalware Service Executable) when accessing URLs containing “urlhaus” or specifically IP 94-154-32-180.

• Third-Party Backup Solution Connectivity Checks

  • Scenario: The enterprise