URLhaus: 167-86-99-169 Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving traffic to a specific cluster of 13 malicious URLs associated with the IP address 167.86.99.169, which are known indicators of compromise for phishing or command-and-control communication. The SOC team should proactively hunt for these URLs in Azure Sentinel to rapidly isolate affected endpoints and prevent potential data exfiltration or lateral movement before broader infection occurs.

IOC Summary

Threat: 167-86-99-169 Total URLs: 13 Active URLs: 13

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 167-86-99-169
let malicious_domains = dynamic(["167.86.99.169"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["167.86.99.169"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 167-86-99-169 Malicious URLs detection rule, including tailored filters and exclusions:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) regularly probe external endpoints to verify patch levels. These tools often generate outbound HTTP/HTTPS requests to known public IP ranges that may overlap with the 167-86-99-169 signature, triggering alerts when they validate certificate chains or fetch threat intelligence feeds.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host attribute. Add the specific asset tags (e.g., AssetType=Scanner) or IP ranges of all internal security scanning appliances to the allowlist for this detection logic.

• Scenario: Cloud Backup and Synchronization Jobs

  • Context: Scheduled backup agents (such as Veeam, Rubrik, or Acronis Cyber Protect) running nightly jobs often connect to cloud storage gateways or update repositories. If the 167-86-99-169 signature encompasses a specific CDN or cloud provider IP used by these backup services, legitimate data synchronization traffic will be flagged as malicious URL access.
  • Filter/Exclusion: Implement a time-based filter excluding alerts generated during defined maintenance windows (e.g., 02:00 - 06:00 UTC) for processes named VeeamBackupService.exe or RubrikAgent. Alternatively, exclude traffic originating from the specific service accounts used by these backup tools.

• Scenario: Software Update and Patch Management

  • Context: Enterprise patch management solutions like **Microsoft