URLhaus: 94-154-43-60 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving a specific cluster of 16 malicious URLs associated with IP 94-154-43-60, which are likely being used for command and control or phishing campaigns. A proactive hunt is essential to validate whether these high-severity indicators have already compromised internal assets within the Azure Sentinel environment before they can exfiltrate data or establish persistent access.

IOC Summary

Threat: 94-154-43-60 Total URLs: 16 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-60
let malicious_domains = dynamic(["94.154.43.60"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.60"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: 94-154-43-60 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Internal security appliances (e.g., CrowdStrike Falcon, Trend Micro Apex One, or SentinelOne) frequently perform daily health checks or signature updates by pinging known URLhaus endpoints to verify connectivity and fetch the latest threat intelligence feeds. These legitimate probes often match the specific IP/URL pattern associated with the 94-154-43-60 tag.
  • Suggested Filter: Create an exclusion rule that suppresses alerts originating from the Source Host list of known security management servers (e.g., Security-Mgmt-Srv-01, Falcon-Manager) or restricts the alert to non-admin user accounts only, as these tools usually run under system or service accounts.

• Scenario: Scheduled Backup and Cloud Sync Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or cloud synchronization agents such as Microsoft OneDrive for Business often initiate outbound connections to verify storage availability or sync metadata. If the 94-154-43-60 URL is part of a broader CDN or verification endpoint used by these tools, scheduled jobs running at off-hours (e.g., 2:00 AM) will trigger the rule.
  • Suggested Filter: Implement a time-based exclusion window for alerts generated between 01:00 and 05:00 on weekdays for specific process names like veeam.exe, OneDriveSync.exe, or msedge.exe (when running as a service), provided the destination URL