URLhaus: 203-159-90-118 Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving connections to known malicious URLs (tagged 203-159-90-118) that may indicate active phishing campaigns or command-and-control communications from compromised endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to rapidly identify and isolate potential threats before they escalate into broader data exfiltration or lateral movement incidents.

IOC Summary

Threat: 203-159-90-118 Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 203-159-90-118
let malicious_domains = dynamic(["203.159.90.118"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["203.159.90.118"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 203-159-90-118 Malicious URLs detection rule, including targeted filters and exclusions:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external IP ranges to verify firewall rules or check for open ports. These tools often generate HTTP/HTTPS requests that match the signature of the malicious URL 203-159-90-118 during their scheduled discovery cycles.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host or Process Name. Exclude traffic originating from known scanner service accounts (e.g., Tenable.Nessus.Service) or specific IP ranges assigned to the security operations center (SOC) infrastructure.

• Scenario: Cloud Backup and Synchronization Agents

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup frequently initiate connections to external update servers or cloud storage endpoints. If 203-159-90-118 is a legitimate CDN node used by these vendors for manifest downloads, the detection logic will flag routine backup synchronization jobs as malicious.
  • Filter/Exclusion: Implement an exclusion based on the Destination Port (e.g., 443) combined with specific Process Paths. Exclude traffic generated by processes located in C:\Program Files\Veeam\ or C:\Windows\System32\DcRmSvc.exe when connecting to known vendor IP ranges.

• Scenario: Scheduled Patch Management Deployments

  • Context: During nightly maintenance windows, patch management tools such as **Microsoft Endpoint