URLhaus: 169-40-135-244 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints attempt to access known malicious infrastructure associated with IP 169-40-135-244, indicating potential command-and-control communication or phishing delivery attempts. Proactively hunting for these specific URL interactions in Azure Sentinel is critical to identify early-stage compromises before they escalate into broader lateral movements or data exfiltration events within the organization’s network.

IOC Summary

Threat: 169-40-135-244 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 169-40-135-244
let malicious_domains = dynamic(["169.40.135.244"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["169.40.135.244"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 169-40-135-244 Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Major endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query the 169-40-135-244 IP range to validate the reputation of update servers or to fetch threat intelligence feeds during scheduled maintenance windows. These connections are initiated by the security agent itself rather than a user browsing activity, often appearing as “malicious” because the URL is known but not yet whitelisted in the specific tenant’s allow-list.
  • Filter/Exclusion: Create an exclusion based on the Source Process Name (e.g., MsMpEng.exe, FalconService.exe) and restrict the rule to trigger only when the process is running under a standard user context, excluding system-level service accounts (SYSTEM, NT AUTHORITY\Network Service).

• Cloud Backup and Synchronization Tasks

  • Scenario: Enterprise backup solutions (e.g., Veeam Backup & Replication, Commvault) or cloud sync tools (e.g., OneDrive for Business, Box Sync) may establish connections to the 169-40-135-244 IP during nightly data replication jobs. These tasks often access specific API endpoints hosted on this IP to verify file integrity or download configuration manifests, triggering a “malicious URL” alert due to high-volume, repetitive traffic patterns that mimic scanning behavior.
  • Filter/Exclusion: Implement a filter based on the Destination Port (e.g., restrict to ports 443 and 80) combined with an exclusion for