URLhaus: 167-99-234-133 Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where internal assets initiate connections to specific malicious IP addresses (167.99.234.133) known for hosting compromised URLs, indicating potential command-and-control communication or drive-by download attacks. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of traffic to this high-severity threat cluster allows the SOC team to isolate affected endpoints before lateral movement or data exfiltration occurs.

IOC Summary

Threat: 167-99-234-133 Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 167-99-234-133
let malicious_domains = dynamic(["167.99.234.133"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["167.99.234.133"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the URLhaus: 167-99-234-133 Malicious URLs detection rule in an enterprise environment:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform background checks against known threat intelligence feeds. The agent may query the specific IP 167-99-234-133 to verify signature definitions or check for new malware hashes before pushing updates to workstations.
  • Filter/Exclusion: Create an exclusion based on the Process Name and User Account. Filter out events where the process is C:\Program Files\CrowdStrike\fsagent.exe (or equivalent Defender service) running under a system account like NT AUTHORITY\SYSTEM or Local Service.

• Scheduled Compliance and Vulnerability Scanning Jobs

  • Scenario: Security Operations teams often run scheduled vulnerability scans using tools like Tenable Nessus or Qualys. These scanners probe internal and external assets to validate connectivity and security posture, which includes pinging known malicious IP ranges to test firewall rules and proxy configurations against the 167-99-234-133 address.
  • Filter/Exclusion: Exclude traffic originating from specific Source Hostnames or IP Ranges dedicated to scanning infrastructure. For example, add a rule to ignore connections from the subnet 10.50.20.0/24 (the designated Security Scanning VLAN) when the destination URL contains the hash associated with this IP.

• IT Administration and Patch Management Workflows

  • Scenario: During monthly maintenance windows, IT administrators utilize patch management tools like Ivanti