URLhaus: 94-154-32-68 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving interactions with specific malicious URLs flagged by URLhaus under the identifier 94-154-32-68, which often indicate initial access or command-and-control communications. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement before the threat escalates within the network.

IOC Summary

Threat: 94-154-32-68 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-68
let malicious_domains = dynamic(["94.154.32.68"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.68"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 94-154-32-68 Malicious URLs detection rule, including suggested filters and exclusions:

• Automated Security Scanner Traffic: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Burp Suite) frequently probe external endpoints to verify certificate validity or reachability. If the scanner’s configuration includes a list of known “bad” URLs for testing purposes, it may trigger this rule when probing 94-154-32-68 even though no actual user interaction occurred.

  • Filter/Exclusion: Exclude network traffic originating from specific IP ranges assigned to the security scanning infrastructure (e.g., Source_IP IN [10.20.1.0/24]) or filter based on the User-Agent string containing keywords like “Nessus”, “Qualys”, or “Burp”.

• Third-Party Cloud Service Heartbeats: Enterprise applications often rely on SaaS platforms (e.g., Microsoft 365, Salesforce, or ServiceNow) that perform periodic health checks against external partner URLs. If 94-154-32-68 is a legitimate endpoint used by one of these services for data synchronization or API validation, the rule may flag routine heartbeat packets as malicious.

  • Filter/Exclusion: Create an exclusion list for known benign destination domains associated with major cloud providers (e.g., *.office.com, *.salesforce.com) when the traffic is initiated by specific service accounts identified in Active Directory (e.g., ServiceAccount_M365Sync).

• Scheduled Backup and Replication Jobs: Automated backup solutions like Veeam, Rubrik, or Commvault often include external verification steps where they fetch metadata