URLhaus: 104-131-86-222 Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where compromised hosts initiate outbound connections to known malicious infrastructure hosted at IP 104-131-86-222, indicating potential command-and-control communication or drive-by download attacks. The SOC team should proactively investigate these specific URL interactions in Azure Sentinel to validate the integrity of affected endpoints and prevent lateral movement before broader network compromise occurs.

IOC Summary

Threat: 104-131-86-222 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 104-131-86-222
let malicious_domains = dynamic(["104.131.86.222"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["104.131.86.222"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 104-131-86-222 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query external threat intelligence feeds to update their local definition databases. The IP 104-131-86-222 is often part of a shared CDN or feed distribution network used by these vendors, triggering the rule during routine background scans on workstations and servers.
  • Filter/Exclusion: Create an exclusion for traffic originating from known Endpoint Protection service accounts (e.g., svc_defender_update) or filter logs where the User-Agent string contains specific vendor identifiers like CrowdStrike-Update or Microsoft-Windows-Defender.

• Scheduled Cloud Backup and Synchronization Jobs

  • Scenario: Automated backup agents such as Veeam Backup & Replication or Commvault initiate outbound connections to verify the integrity of remote storage targets or download patch manifests. If the organization utilizes a cloud provider that routes traffic through 104-131-86-222 for content delivery, these scheduled nightly jobs (e.g., running at 02:00 UTC) will generate repeated hits on this rule.
  • Filter/Exclusion: Exclude traffic from the specific subnet ranges assigned to backup servers (e.g., 10.50.20.0/24) during scheduled maintenance windows, or filter based on destination ports commonly used by these agents (e.g., TCP 8080, 9443) when the source is a