URLhaus: 185-69-122-37 Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are actively leveraging known malicious infrastructure at IP 185-69-122-37 to exfiltrate data or deliver payloads via compromised web traffic within the organization’s network. Proactive hunting in Azure Sentinel is critical to identify early-stage lateral movement and validate whether these specific URLs are being accessed by unexpected user accounts or endpoints, thereby preventing potential compromise before automated alerts trigger.

IOC Summary

Threat: 185-69-122-37 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 185-69-122-37
let malicious_domains = dynamic(["185.69.122.37"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["185.69.122.37"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 185-69-122-37 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment.

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager frequently scan external repositories to check for the latest security updates. These agents may query a specific URL hosted on 185-69-122-37 that has been flagged by URLhaus due to historical behavior, even though the current content is benign and essential for patching.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., ccmexec.exe, IvantiAgentService.exe) combined with a specific User Account (e.g., DOMAIN\svc-patch-agent). Additionally, filter by HTTP Method to only exclude GET requests originating from these service accounts during business hours.

• Scenario: Third-Party Cloud Backup Verification

  • Context: Scheduled backup verification jobs running on servers using tools like Veeam Backup & Replication or Commvault often perform integrity checks against external storage endpoints. If the IP 185-69-122-37 is part of a cloud provider’s edge network used for off-site validation, these routine connectivity pings trigger the rule despite being legitimate administrative traffic.
  • Suggested Filter/Exclusion: Exclude traffic where the Destination Port is 443 (HTTPS) and the Source Hostname matches known backup server naming conventions (e.g., BKP-PROD-*). Implement a time-based filter to suppress alerts for this rule between 01