URLhaus: 94-154-32-8 Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging known malicious URLs from the URLhaus database to deliver payloads associated with the 94-154-32-8 malware family, which often serve as initial access vectors for phishing or drive-by attacks. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of traffic to these specific malicious domains can prevent lateral movement and data exfiltration before the infection spreads across the enterprise network.

IOC Summary

Threat: 94-154-32-8 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-32-8
let malicious_domains = dynamic(["94.154.32.8"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.32.8"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 94-154-32-8 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Patching Tools Scanning Vendor Archives

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently query vendor repositories to check for updates. These tools often generate HTTP requests to IP addresses hosting update manifests that may be flagged as “malicious” by URLhaus due to high traffic volume or shared hosting, even though the content is benign.
  • Filter/Exclusion: Create a whitelist rule excluding source IPs belonging to the internal patch management servers (e.g., 10.20.50.x) and destination URLs containing specific vendor domains (e.g., *.microsoft.com, *.adobe.com). Alternatively, exclude traffic where the User-Agent string contains “SCCM” or “Ivanti”.

• Scenario: Scheduled Backup Agents Querying Cloud Storage Endpoints

  • Context: Data protection solutions such as Veeam Backup & Replication or Rubrik execute scheduled jobs to verify connectivity and retrieve metadata from cloud storage gateways. These agents often initiate connections to external IP addresses that host backup buckets, which may be misidentified as malicious by the detection logic due to dynamic DNS resolution or shared infrastructure IPs.
  • Filter/Exclusion: Implement a time-based exclusion for traffic occurring during known maintenance windows (e.g., 02:00–04:00 UTC) originating from backup service accounts. Additionally, exclude destination URLs that match the specific S3 bucket patterns used by the organization’s cloud provider (e.g., *.s3.amazonaws.com).

• **Scenario: Endpoint Security Agents Performing Cloud Threat Intelligence Lookups