URLhaus: 192-159-99-42 Malicious URLs

Hunt Hypothesis

This rule detects adversary activity involving network traffic to malicious URLs associated with the IP address 192.159-99-42, which are known indicators of compromise from the URLhaus threat intelligence feed. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify early-stage web-based threats and prevent potential data exfiltration or malware execution before they impact critical assets.

IOC Summary

Threat: 192-159-99-42 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-159-99-42
let malicious_domains = dynamic(["192.159.99.42"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.159.99.42"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 192-159-99-42 Malicious URLs detection rule:

• Scenario: The enterprise’s automated patch management system (e.g., Microsoft Endpoint Configuration Manager or WSUS) initiates a scheduled nightly job to download security updates from the vendor’s repository hosted at https://updates.vendor-cdn.net/192-159-99-42.

  • Suggested Filter: Exclude traffic where the source process name matches wsusclient.exe or ccmsetup.exe and the destination URL contains the path segment /downloads/patches/.

• Scenario: A third-party backup solution (e.g., Veeam Backup & Replication) performs a routine integrity check by connecting to its cloud management portal, which resolves to the IP range containing 192.159.99-42 for API telemetry uploads.

  • Suggested Filter: Create an exclusion rule allowing all outbound HTTPS traffic from the specific service account svc-veeam-backup on the host backup-srv-01, regardless of the destination URL hash.

• Scenario: The internal DevOps pipeline (e.g., Jenkins or GitLab CI) triggers a container build that pulls a base image from an external registry, where the registry’s CDN node is identified by this specific IP signature during the docker pull phase.

  • Suggested Filter: Whitelist URLs containing the path /v2/manifests and originating from the subnet 10.50.20.x (the CI/CD cluster), specifically filtering out alerts where the HTTP User-Agent string contains “Jenkins” or “GitLab-Runner”.

• Scenario: The corporate endpoint protection suite (