URLhaus: 167-99-106-125 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving initial access or command-and-control communications through specific malicious URLs identified by URLhaus with the tag 167-99-106-125. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage web-based threats and prevent potential data exfiltration before they escalate into broader incidents.

IOC Summary

Threat: 167-99-106-125 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 167-99-106-125
let malicious_domains = dynamic(["167.99.106.125"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["167.99.106.125"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: 167-99-106-125 Malicious URLs detection rule, tailored for an enterprise environment:

• Legacy Patch Management Agent Communication

  • Scenario: The organization utilizes Ivanti Neurons for Endpoint Manager (or similar legacy agents) which periodically contacts a specific internal repository hosted on the IP 167.99.106.125 to check for critical security patches and software updates. This traffic is often flagged because the agent uses an older SSL certificate or connects directly via HTTP before upgrading to HTTPS, mimicking the behavior of the malicious signature.
  • Filter/Exclusion: Create a whitelist rule excluding all outbound traffic from the IvantiAgent process (e.g., agent.exe) destined for IP 167.99.106.125. Additionally, verify the URL path contains /updates/repository to ensure it matches the legitimate update flow.

• Scheduled Third-Party Compliance Reporting

  • Scenario: A nightly scheduled job running on a dedicated SQL Server instance uses PowerShell scripts (Start-ScheduledTask) to pull compliance data from an external vendor’s portal hosted at 167.99.106.125. The job executes via the SYSTEM account and generates high-volume GET requests that trigger the URLhaus heuristic due to the sheer volume of unique resource requests in a short window, resembling a scanning or exfiltration pattern.
  • Filter/Exclusion: Implement an exclusion based on the source process name (powershell.exe) combined with the specific command line argument containing the vendor’s API endpoint (e.g., --uri https://167.99.106.125/api/compliance). Restrict this exclusion