URLhaus: 94-154-43-76 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious URLs hosted on IP 94-154-43-76, which are known to distribute malware as flagged by URLhaus. Proactively hunting for these specific indicators in Azure Sentinel is critical to intercept potential web-based infection vectors before they compromise internal assets or exfiltrate sensitive data.

IOC Summary

Threat: 94-154-43-76 Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-76
let malicious_domains = dynamic(["94.154.43.76"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.76"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 94-154-43-76 Malicious URLs detection rule, including targeted filters and exclusions:

• Automated Patch Management Scans

  • Scenario: Enterprise patch management tools (e.g., Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons) frequently query external vendor repositories to check for updates. These tools often initiate connections to IP 94-154-43-76 as part of their routine health checks, which the rule flags as a potential malicious URL interaction due to the IP’s reputation in the URLhaus database.
  • Filter/Exclusion: Create a whitelist exclusion for the specific source FQDNs or IP ranges of your patch management servers (e.g., SCCM-Primary01.corp.local). Additionally, filter out traffic where the User-Agent string contains keywords like “WUA” (Windows Update Agent) or “IvantiPatch”.

• Cloud Backup and Synchronization Agents

  • Scenario: Background processes from cloud backup solutions such as Veeam Backup & Replication or Rubrik periodically connect to external metadata services or update servers hosted at 94-154-43-76. These connections are legitimate administrative tasks involving data synchronization and license validation, not user-initiated browsing sessions.
  • Filter/Exclusion: Exclude traffic originating from the service accounts used by backup agents (e.g., svc-veeam-backup or svc-rubrik). Implement a rule condition that ignores alerts where the destination port is non-standard for web browsing (e.g., excluding ports 443 if the source is known to be a backup server using custom ports).

• Scheduled Compliance and Reporting Jobs *