URLhaus: 64-89-163-22 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints communicate with specific malicious URLs identified by URLhaus (tagged 64-89-163-22), indicating potential command-and-control activity or initial infection vectors. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly identify compromised assets and block lateral movement before the threat escalates within the organization’s network perimeter.

IOC Summary

Threat: 64-89-163-22 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 64-89-163-22
let malicious_domains = dynamic(["64.89.163.22"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["64.89.163.22"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 64-89-163-22 Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Software License Validation

  • Context: The internal IT deployment tool (e.g., Microsoft SCCM/MECM or Ivanti) performs scheduled checks against the vendor’s license server to validate software keys. If the vendor recently updated their endpoint or if the URL 64-89-163-22 is a newly registered subdomain used for API handshakes, legitimate traffic from hundreds of workstations may trigger the rule simultaneously during business hours.
  • Suggested Filter/Exclusion: Create an exclusion based on the Source IP range of the management servers (e.g., 10.20.50.0/24) or filter by the specific Process Name (ccmexec.exe for SCCM) initiating the connection, provided the destination port is standard HTTP/HTTPS (80/443).

• Scenario: Third-Party Cloud Backup Agent Heartbeats

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Acronis Cyber Protect run background agents on file servers. These agents periodically contact the vendor’s cloud control plane for status updates and policy synchronization. If 64-89-163-22 is part of the vendor’s global load-balanced infrastructure, these routine “heartbeat” packets may be flagged as malicious by URLhaus due to a recent IP reputation update that hasn’t yet been whitelisted in the enterprise proxy.
  • Suggested Filter/Exclusion: Exclude traffic where the User-Agent string contains specific identifiers (e.g., `Veeam