URLhaus: 137-184-35-2 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving user or system interactions with specific malicious web endpoints identified by URLhaus under the signature 137-184-35-2, which often indicate early-stage phishing campaigns or command-and-control communications. The SOC team should proactively investigate these URLs in Azure Sentinel to validate potential lateral movement or data exfiltration attempts before they escalate into confirmed incidents.

IOC Summary

Threat: 137-184-35-2 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 137-184-35-2
let malicious_domains = dynamic(["137.184.35.2"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["137.184.35.2"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 137-184-35-2 Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Vulnerability Scanning from Security Appliances

  • Scenario: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe internal and external assets. These tools often generate HTTP requests to known malicious IP ranges or URLs to verify firewall rules, test SSL certificate validity, or benchmark threat intelligence feeds against the specific 137-184-35-2 signature.
  • Filter/Exclusion: Create an exclusion rule that filters out traffic originating from the static IP addresses of the vulnerability scanner appliances (e.g., Source_IP IN [Tenable_Scanner_Range]) or specific service accounts used by these tools (e.g., User_Agent CONTAINS "Nessus").

• Endpoint Protection Definition Updates

  • Scenario: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint, frequently connect to threat intelligence hubs to download the latest signature definitions. The 137-184-35-2 tag often corresponds to a specific malware family; EDRs may query these URLs during their scheduled daily update cycle (e.g., every morning at 06:00 UTC) to validate the integrity of new definition packages before deployment.
  • Filter/Exclusion: Exclude traffic from the specific EDR service accounts or processes (e.g., Process_Name = "csagent.exe" or "SentinelOneService") and restrict the exclusion to business hours or scheduled maintenance windows where updates are expected.

• **IT