This hypothesis targets potential web-based initial access or command-and-control activity by identifying traffic to the specific malicious IP 192.159.99.221, a known URLhaus entry associated with high-severity threats. Proactively hunting for these connections in Azure Sentinel allows the SOC to detect compromised endpoints or lateral movement attempts before they escalate into a full breach or data exfiltration event.
Threat: 192-159-99-221 Total URLs: 2 Active URLs: 0
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://192.159.99.221/Bin/ScreenConnect.ClientSetup.exe | offline | malware_download | 2026-09-07 |
hxxp://192.159.99.221/bin/support.client.exe | offline | malware_download | 2026-09-07 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-159-99-221
let malicious_domains = dynamic(["192.159.99.221"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.159.99.221"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
192.159.99.221) for a non-critical telemetry endpoint or a specific microservice that was never migrated to a DNS name.
svc-legacy-app) or the destination port is a known internal service port (e.g., 8080 or 8443) if the IP is confirmed to be an internal asset.rsync or a custom PowerShell script) pushes data to a staging server that has been assigned this static IP address for internal network segmentation.
svc-backup-agent) or filter out traffic on standard backup ports (e.g., 873 for rsync, 445 for SMB) if the IP is verified as an internal staging host.jenkins-agent-01, dev-laptop-12) and the destination port is a typical HTTP/HTTPS port (80, 443) during business hours.nmap, ping, or a custom health check script) periodically probes this IP address to verify service availability or network reachability.