URLhaus: 157-230-50-234 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised hosts initiate outbound connections to known malicious IP addresses (157.230.50.234) associated with active threat intelligence feeds from URLhaus. Proactively hunting for these specific URLs in Azure Sentinel is critical because early detection of this high-severity indicator can prevent lateral movement and data exfiltration before automated alerts trigger a response.

IOC Summary

Threat: 157-230-50-234 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 157-230-50-234
let malicious_domains = dynamic(["157.230.50.234"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["157.230.50.234"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: 157-230-50-234 Malicious URLs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment.

• Automated Patch Management Scans by SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager performs scheduled background updates where the ccmexec.exe service queries external repositories to check for the latest definition signatures and patch metadata. If the IP 157-230-50-234 hosts a legitimate update feed or a third-party software vendor’s repository used by SCCM, the initial connection will trigger the rule before the URL is fully whitelisted in the local cache.
  • Suggested Filter/Exclusion: Create an exclusion for network traffic originating from the SCCM service account (e.g., DOMAIN\SCCM-SVC) or specifically filter out HTTP/HTTPS requests where the User-Agent string contains “Microsoft-ConfigurationManager” and the destination IP is 157.230.50.234.

• Cloud Backup Agent Heartbeats

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled heartbeat jobs where the backup agent (vrb.exe or simagent) contacts a cloud storage gateway or an external API endpoint to verify connectivity and upload small metadata files. If the IP 157-230-50-234 is part of the backup vendor’s global load balancer, these routine health checks will generate alerts despite being benign traffic.
  • Suggested Filter/Exclusion: Exclude traffic from known backup agent processes (e.g., VeeamAgent.exe, simagent) communicating with port