URLhaus: 94-154-32-38 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving communication with specific malicious URLs flagged by URLhaus under the identifier 94-154-32-38, which often indicate active phishing campaigns or command-and-control traffic. A proactive hunt in Azure Sentinel is essential to immediately isolate affected endpoints and prevent potential data exfiltration or lateral movement before the threat escalates across the network.

IOC Summary

Threat: 94-154-32-38 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-38
let malicious_domains = dynamic(["94.154.32.38"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.38"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 94-154-32-38 Malicious URLs detection rule:

• Scenario: Automated Cloud Backup Verification

  • Context: The enterprise uses Veeam Backup & Replication to perform daily integrity checks. The backup service periodically contacts the URLhaus API endpoint (hosted at 94.154.32.38) to verify the status of critical security feeds before archiving logs, triggering a network connection that looks like an outbound malicious scan.
  • Suggested Filter: Create an exclusion rule for traffic originating from the specific service account or host IP range (e.g., 10.50.20.15) where the destination is 94.154.32.38 and the User-Agent string contains “Veeam.BR”.

• Scenario: Scheduled Endpoint Security Policy Sync

  • Context: The organization deploys CrowdStrike Falcon agents configured to sync threat intelligence updates every morning at 06:00 UTC via a scheduled task. During this window, the agent queries the URLhaus feed hosted on IP 94.154.32.38 to download the latest reputation database, which the rule interprets as a potential malicious URL interaction.
  • Suggested Filter: Implement a time-based exclusion (06:00–07:00 UTC) for traffic from the CrowdStrike management server subnet (192.168.50.0/24) targeting port 443 on 94.154.32.38.

• Scenario: Third-Party SIEM Data Ingestion

  • Context: The central Splunk Enterprise instance