URLhaus: 94-154-32-41 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving malicious web traffic from the specific IP address 94.154.32.41, which is associated with known threat intelligence feeds in URLhaus. A proactive hunt for this behavior within Azure Sentinel is critical to rapidly isolate potential initial access vectors or command-and-control communications before they compromise sensitive enterprise assets.

IOC Summary

Threat: 94-154-32-41 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-41
let malicious_domains = dynamic(["94.154.32.41"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.41"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3–5 specific false positive scenarios for the URLhaus: 94-154-32-41 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Security Feed Ingestion by SIEM/EDR Agents

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or SIEM systems (e.g., Splunk, Sentinel) periodically query external threat intelligence feeds to update local signatures. The IP 94-154-32-41 may be part of a trusted feed provider’s infrastructure that the agents poll daily.
  • Filter/Exclusion: Create an exclusion based on the Process Name and User Context. Exclude alerts where the initiating process is DefenderService.exe, CrowdStrike.exe, or Splunk-Forwarder.exe running under the system account (NT AUTHORITY\SYSTEM) or a dedicated service account (e.g., svc-threat-intel).

• Scenario: Scheduled Cloud Backup and Synchronization Jobs

  • Context: Background synchronization tasks for cloud storage (e.g., OneDrive, Google Drive, Dropbox Business) often connect to external endpoints for metadata verification. If the backup infrastructure utilizes a CDN or load balancer hosted at 94-154-32-41, legitimate sync traffic will trigger this rule during peak business hours or scheduled maintenance windows.
  • Filter/Exclusion: Implement a time-based exclusion combined with a Destination URL Pattern. Exclude alerts occurring between 02:00 and 06:00 (local time) where the destination URL contains known backup domains (e.g., *.office365.com, *.dropboxbusiness.com) or matches the specific IP range of the enterprise