URLhaus: 192-162-199-186 Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving connections to a specific set of five malicious URLs associated with the IP address 192.162-199-186, which are known indicators of compromise for potential web-based threats. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly identify and isolate affected endpoints before lateral movement or data exfiltration occurs.

IOC Summary

Threat: 192-162-199-186 Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-162-199-186
let malicious_domains = dynamic(["192.162.199.186"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.162.199.186"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 192-162-199-186 Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanning Tools

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external IPs to verify firewall rules and network reachability. These tools often generate HTTP/HTTPS requests to known public IP ranges, including 192.162.199.186, which may be flagged as “malicious” by URLhaus due to its high volume of traffic or previous historical alerts, even though the current interaction is a legitimate health check.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Source Host or Process Name. Exclude alerts where the source process is nessus.exe, qualyspcapd.exe, or rapid7-agent and the destination IP matches 192.162.199.186. Alternatively, if the scanner runs on a specific subnet (e.g., 10.50.10.0/24), add that CIDR block to the rule’s exclusion list.

• Scenario: Scheduled Cloud Backup and Synchronization Jobs

  • Context: Automated backup agents (such as Veeam, Rubrik, or Microsoft Azure Arc) often initiate scheduled jobs during off-hours to sync metadata or verify connectivity with cloud storage endpoints. If the IP 192.162.199.186 is part of a partner CDN or a specific SaaS endpoint used by these backup solutions, the recurring traffic will trigger the rule repeatedly as “malicious” despite being