URLhaus: 94-154-43-192-8081 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based intrusion attempts by identifying traffic to a known malicious IP and port (94.154.43.192:8081) associated with the URLhaus threat feed. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC to detect early-stage reconnaissance or payload delivery before adversaries can establish a foothold or execute further post-compromise actions.

IOC Summary

Threat: 94-154-43-192-8081 Total URLs: 17 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-192-8081
let malicious_domains = dynamic(["94.154.43.192"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.192"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: An internal Java-based legacy ERP system (e.g., SAP NetWeaver or Oracle EBS) configured with a hardcoded external monitoring endpoint or a misconfigured “ping” service pointing to http://94-154-43-192-8081:8081/health for uptime verification.

  • Filter/Exclusion: Exclude traffic where the User-Agent contains Java/ or Apache-HttpClient/ and the destination port is 8081, specifically if the source IP is within the 10.20.0.0/16 range (Legacy App Tier).

• CI/CD Pipeline Artifact Download: A Jenkins or GitLab CI job running a wget or curl command to fetch a build artifact or dependency from a temporary staging server that was mistakenly assigned the IP 94.154.43.192 on port 8081 during a maintenance window.

  • Filter/Exclusion: Exclude events where the process name is curl.exe, wget.exe, or powershell.exe and the command line contains /artifacts/ or /builds/, and the source host matches the CI/CD runner pool (e.g., ci-runner-01 to ci-runner-10).

• Developer Localhost Proxy Misconfiguration: A developer’s workstation using a local proxy tool (like Fiddler, Charles Proxy, or ngrok) that forwards a local development server (running on localhost:8081) to the external IP 94.154.43.192 for remote debugging or sharing a demo environment.

  • Filter/Exclusion: Exclude traffic originating from hosts tagged with dev-workstation or qa-env