URLhaus: 185-69-123-172 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised hosts initiate outbound connections to known malicious infrastructure at IP 185-69-123-172, indicating potential command-and-control activity or malware distribution via URLhaus intelligence. Proactively hunting for these specific URLs in Azure Sentinel is critical because the high severity rating suggests an active threat that requires immediate validation and containment before lateral movement occurs across the enterprise network.

IOC Summary

Threat: 185-69-123-172 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 185-69-123-172
let malicious_domains = dynamic(["185.69.123.172"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["185.69.123.172"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 185-69-123-172 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scheduled Antivirus Definition Updates via Vendor Portals

  • Scenario: Enterprise endpoints (e.g., Windows 10/11 workstations) or servers running CrowdStrike Falcon or Symantec Endpoint Protection initiate a scheduled update job at 2:00 AM. These agents query the vendor’s cloud repository, which hosts dynamic content delivery networks (CDNs). If the IP 185-69-123-172 is part of the vendor’s upstream infrastructure or a specific sub-domain used for signature downloads, the traffic will trigger the rule despite being benign.
  • Suggested Filter: Exclude HTTP/HTTPS traffic where the User-Agent string contains known enterprise EDR identifiers (e.g., CrowdStrike-Defender, Symantec-Client) AND the destination port is restricted to standard update ports (443, 80).

• Automated Patch Management and Compliance Scans

  • Scenario: The IT Operations team utilizes Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons to push monthly security patches. During the “pre-flight” check phase, these management consoles ping external validation servers to verify patch availability. If 185-69-123-172 is a known IP for a third-party software repository (e.g., a Microsoft Update partner or a specific SaaS vendor like Okta or ServiceNow) used by the organization, legitimate HTTP requests from the management server will be flagged.
  • Suggested Filter: Create an exclusion rule based on the Source IP range