URLhaus: 94-154-43-74 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior involving the consumption of malicious URLs hosted on IP 94.154.43.74, which are known to deliver malware payloads as flagged by URLhaus. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement or data exfiltration stemming from these high-severity threats.

IOC Summary

Threat: 94-154-43-74 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-74
let malicious_domains = dynamic(["94.154.43.74"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.74"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: 94-154-43-74 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Automated Security Scanner Traffic from Internal Assets

  • Scenario: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to check for open ports or web vulnerabilities. These tools often generate HTTP/HTTPS requests to known public IPs, including the IP 94-154-43-74, which may be flagged by URLhaus as a potential malicious sinkhole or scanner node rather than user-initiated browsing.
  • Filter/Exclusion: Create an exclusion rule in your SIEM (e.g., Splunk, Sentinel) to suppress alerts where the Source IP belongs to the internal subnet range of the security team (e.g., 10.20.50.x) and the User Agent string contains keywords like “Tenable,” “Qualys,” or “Rapid7.”

• Scheduled Cloud Backup and Sync Operations

  • Scenario: Enterprise backup solutions such as Veeam, Rubrik, or cloud sync tools like Microsoft OneDrive for Business and Dropbox Business often maintain persistent connections to external update servers. These services may initiate background traffic to 94-154-43-74 for policy updates, license validation, or delta synchronization, which the detection logic interprets as a potential malicious URL interaction.
  • Filter/Exclusion: Implement a filter that excludes alerts where the Destination Port is 443 (HTTPS) and the Process Name matches specific backup executables (e.g., VeeamAgent.exe,