URLhaus: 94-154-32-205 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving the consumption of specific malicious URLs identified by URLhaus (tagged 94-154-32-205), which are likely indicators of phishing campaigns or command-and-control communications. The SOC team should proactively search for these URLs in Azure Sentinel to identify early-stage compromises and prevent potential data exfiltration or lateral movement before broader infection occurs.

IOC Summary

Threat: 94-154-32-205 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-205
let malicious_domains = dynamic(["94.154.32.205"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.205"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 94-154-32-205 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Cloud Backup Agents

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently connect to the IP 94.154.32.205 (or associated URL paths) during scheduled nightly jobs to fetch configuration updates, license validation tokens, or microservice manifests from a central cloud repository.
  • Filter/Exclusion: Create an exclusion rule based on Process Name and Source User. Exclude alerts where the process is VeeamService.exe (or rubrik-agent) running under the system account (NT SYSTEM) or a dedicated backup service account, specifically during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Third-Party SIEM/EDR Telemetry

  • Context: Security tools such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often utilize this specific IP range to upload telemetry data, download threat intelligence feeds, or perform cloud-based policy synchronization. The rule may misinterpret these high-volume outbound connections as malicious user browsing activity.
  • Filter/Exclusion: Implement a filter based on the Destination Port and Protocol. Exclude traffic where the destination port is 443 (HTTPS) and the source process belongs to known EDR agents (e.g., falcon-sensor.exe, SentinelOneAgent.exe). Additionally, whitelist the specific URL path /api/v1/telemetry if the detection logic parses full URLs.

• **Scenario: Corporate