URLhaus: 192-159-99-153 Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of malicious web resources hosted on the IP address 192.159-99-153, which are flagged by URLhaus as active threats. The SOC team should proactively investigate these URLs in Azure Sentinel to identify potential initial access or command-and-control activities that could lead to data exfiltration or lateral movement within the network.

IOC Summary

Threat: 192-159-99-153 Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 192-159-99-153
let malicious_domains = dynamic(["192.159.99.153"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.159.99.153"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 192-159-99-153 Malicious URLs detection rule in an enterprise environment:

• Scenario: Scheduled backup agents (e.g., Veeam, Commvault) initiating connectivity checks to a cloud-based license server or metadata repository hosted on the IP 192.159.99.153.

  • Filter/Exclusion: Create an exclusion rule based on the specific process name (e.g., veeam.service.exe or commvault.cmd) and restrict it to the dedicated backup server group, ensuring only these processes accessing this IP are ignored.

• Scenario: Automated patch management tools (e.g., Microsoft Endpoint Configuration Manager/SCCM or Ivanti) downloading update manifests or verifying digital signatures from a vendor’s distribution node located at 192.159-99-153.

  • Filter/Exclusion: Implement an exclusion for the service account running the patch engine (e.g., LocalSystem or SCCM_Service_Account) and limit the scope to specific “Patch Server” subnets during defined maintenance windows (e.g., 02:00–06:00 UTC).

• Scenario: Enterprise-wide SaaS integration services (e.g., Salesforce, ServiceNow) performing nightly data synchronization or API health checks against a partner gateway residing at this IP.

  • Filter/Exclusion: Add an exclusion for the specific application identity (e.g., SalesforceSync.exe or ServiceNowAgent) and whitelist the destination URL pattern if the rule allows, or exclude based on the source user context of the “Integration Service” account.

• Scenario: Internal IT administration teams running manual ad-hoc scans using security tools (e.g., CrowdStrike