URLhaus: 192-159-99-164 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of known malicious web resources hosted on the IP address 192.159-99-164, which are frequently associated with phishing campaigns and malware distribution. A proactive search within Azure Sentinel is essential to identify early-stage compromise indicators before they escalate into broader lateral movement or data exfiltration events across the enterprise network.

IOC Summary

Threat: 192-159-99-164 Total URLs: 8 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-159-99-164
let malicious_domains = dynamic(["192.159.99.164"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.159.99.164"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding filters for the URLhaus: 192-159-99-164 Malicious URLs detection rule in a legitimate enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools, such as Tenable Nessus, Qualys, or Rapid7 InsightVM, frequently scan external assets. If the scanner is configured to probe specific IP ranges or download test payloads from the 192.159.99.164 subnet (often used for testing or CDN edge nodes), it may generate legitimate connections that match the malicious URL signature.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host attribute, filtering out traffic originating from known scanner FQDNs (e.g., scanner-01.corp.local) or specific IP ranges dedicated to security operations (e.g., 10.50.20.0/24).

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup often utilize specific IP ranges for their cloud gateways. If the 192.159.99.164 address is part of a partner storage gateway or a CDN used by these tools, scheduled nightly jobs (e.g., Backup-Job-Prod) will trigger the detection while uploading metadata or syncing logs.
  • Filter/Exclusion: Implement an exclusion based on Process Name and Time Window. Exclude alerts where the initiating process is VeeamTransport.exe or AzureBackupAgent.exe occurring during defined maintenance windows (e.g., 01:00–05:00 UTC).