URLhaus: 94-154-43-37 Malicious URLs

Hunt Hypothesis

This hypothesis targets potential web-based intrusion attempts by identifying user interactions with a specific set of 11 malicious URLs associated with the IP address 94-154-43-37, which may indicate compromised endpoints or phishing campaigns. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage reconnaissance or payload delivery before adversaries can establish a foothold or execute further malicious activities within the environment.

IOC Summary

Threat: 94-154-43-37 Total URLs: 11 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-37
let malicious_domains = dynamic(["94.154.43.37"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.37"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) configured with a hardcoded health-check endpoint that points to the attacker’s infrastructure for load balancing or failover verification.

  • Filter/Exclusion: Exclude source IPs belonging to the specific application server subnet (e.g., 10.20.5.0/24) or filter by user-agent strings specific to the health-check script (e.g., curl/7.68.0 or python-requests/2.25.1).

• Automated Backup Verification Jobs: A scheduled PowerShell or Bash script that runs nightly to verify backup integrity by pinging a known external endpoint (which was inadvertently compromised or reused by the attacker) to confirm network egress capabilities.

  • Filter/Exclusion: Exclude traffic from the backup management server (e.g., Veeam or Commvault agent) where the destination port is 80/443 and the source process is powershell.exe or bash with a specific scheduled task name (e.g., BackupVerify_Nightly).

• CI/CD Pipeline Dependency Fetching: A Jenkins or GitLab CI runner that fetches a specific artifact or configuration file from a shared repository hosted on the attacker’s IP (used as a temporary mirror before migration) during a build step.

  • Filter/Exclusion: Exclude source IPs from the CI/CD runner pool (e.g., 192.168.100.0/24) and filter by HTTP headers containing X-Jenkins-Job-Name or Gitlab-CI-Runner-ID.

• Developer Sandbox Testing: A developer in the QA environment using a local proxy (like Fiddler or Charles Proxy) to test API integrations against a staging environment that is temporarily