URLhaus: 77-91-123-220 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints communicate with known malicious infrastructure identified by URLhaus, specifically the IP range 77-91-123-220, to detect potential command-and-control activity or phishing campaigns. Proactively hunting for these specific URLs in Azure Sentinel is critical because early identification of this high-severity threat allows the SOC team to isolate compromised assets and block malicious traffic before lateral movement occurs across the network.

IOC Summary

Threat: 77-91-123-220 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 77-91-123-220
let malicious_domains = dynamic(["77.91.123.220"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["77.91.123.220"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 77-91-123-220 Malicious URLs detection rule in an enterprise environment:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: The Windows Update service or third-party agents like CrowdStrike Falcon and SentinelOne frequently query the IP range 77.91.123.0/24 to check for signature updates, threat intelligence feeds, or patch availability. These background connections are often initiated by system accounts (e.g., NT AUTHORITY\SYSTEM) rather than interactive users, leading to high-volume traffic that triggers the rule despite being benign administrative maintenance.
  • Suggested Filter: Exclude network flows where the source process is a known security agent or OS update service (e.g., ProcessName contains “CrowdStrike”, “SentinelOne”, “svchost.exe” with command line containing “wuserv”) and the destination port is standard HTTPS (443) or HTTP (80).

• Scheduled Cloud Backup and Synchronization Jobs

  • Scenario: Enterprise backup solutions such as Veeam Backup & Replication, Commvault, or Microsoft Azure Backup Agent perform scheduled synchronization tasks that connect to external storage repositories or metadata servers hosted within the 77.91.123-220 range. These jobs typically run during off-hours (e.g., 02:00–04:00) and generate large data transfers that mimic malicious scanning behavior, especially if the backup server acts as a proxy for multiple workstations.
  • Suggested Filter: Create an exclusion based on scheduled time windows (e.g., EventTime between 01:00 and 05