URLhaus: 94-154-43-95-8081 Malicious URLs

Hunt Hypothesis

This hunt targets potential web-based intrusion attempts by identifying traffic to a cluster of 17 malicious URLs associated with the IP 94.154.43.95, which adversaries may use for command-and-control channels or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage web interactions that could lead to credential theft or malware execution before they escalate into a full compromise.

IOC Summary

Threat: 94-154-43-95-8081 Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 94-154-43-95-8081
let malicious_domains = dynamic(["94.154.43.95"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.95"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal application (e.g., a custom-built inventory management system) uses a hardcoded API endpoint pointing to http://94.154.43.95:8081/api/v1/sync for data synchronization. This traffic is generated by a scheduled Windows Task running every 15 minutes on a specific application server.

  • Filter/Exclusion: Exclude network connections where the source IP is the known Application Server IP (e.g., 10.20.5.12) and the destination port is 8081, specifically if the user account is a service account like svc-inventory-app.

• Scenario: A developer is testing a new microservice in a non-production environment (Dev/Test) and has configured the service to call a staging backend hosted at 94.154.43.95:8081 to validate integration logic. This occurs on a developer workstation or a CI/CD runner agent.

  • Filter/Exclusion: Exclude alerts originating from user agents tagged with environment:dev or environment:test, or specifically exclude source IPs within the designated developer subnet (e.g., 192.168.100.0/24).

• Scenario: A third-party SaaS tool (e.g., a log aggregation agent or a backup client) is configured to send telemetry or backup chunks to a specific endpoint at 94.154.43.95:8081 as part of its vendor-specific configuration. This traffic appears on multiple hosts running the agent.

  • Filter/Exclusion: Exclude connections where the source process name matches the known vendor binary (e.g., vbackup-agent.exe or telemetry-collector) and the destination is `94.1