This hypothesis targets adversaries executing 32-bit payloads via known malicious URLs, a common tactic for initial access or lateral movement that often bypasses 64-bit-specific controls. Proactively hunting for these specific URL patterns in Azure Sentinel allows the SOC to identify compromised hosts early, reducing the dwell time of threats that leverage legacy architecture vulnerabilities.
Threat: 32-bit Total URLs: 36 Active URLs: 36
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://196.190.10.252:36061/i | online | malware_download | 2026-09-13 |
hxxp://182.126.119.104:53515/i | online | malware_download | 2026-09-13 |
hxxp://115.58.121.22:46152/i | online | malware_download | 2026-09-13 |
hxxp://105.186.143.114:35689/i | online | malware_download | 2026-09-13 |
hxxp://196.190.10.252:36061/bin.sh | online | malware_download | 2026-09-13 |
hxxp://105.186.143.114:35689/bin.sh | online | malware_download | 2026-09-13 |
hxxp://66.212.187.214:58335/bin.sh | online | malware_download | 2026-09-13 |
hxxp://115.58.121.22:46152/bin.sh | online | malware_download | 2026-09-13 |
hxxp://182.121.59.52:33634/bin.sh | online | malware_download | 2026-09-13 |
hxxp://182.116.48.4:52963/bin.sh | online | malware_download | 2026-09-13 |
hxxp://39.74.115.234:54244/i | online | malware_download | 2026-09-13 |
hxxp://115.49.232.50:33070/i | online | malware_download | 2026-09-13 |
hxxp://182.116.116.237:50764/i | online | malware_download | 2026-09-13 |
hxxp://39.74.115.234:54244/bin.sh | online | malware_download | 2026-09-13 |
hxxp://175.146.5.1:44723/bin.sh | online | malware_download | 2026-09-13 |
hxxp://190.109.227.236:33009/i | online | malware_download | 2026-09-13 |
hxxp://190.109.227.236:33009/bin.sh | online | malware_download | 2026-09-13 |
hxxp://182.116.116.237:50764/bin.sh | online | malware_download | 2026-09-13 |
hxxp://119.115.144.69:46446/i | online | malware_download | 2026-09-13 |
hxxp://94.233.15.145:59216/i | online | malware_download | 2026-09-13 |
hxxp://175.148.71.5:43235/bin.sh | online | malware_download | 2026-09-13 |
hxxp://94.156.166.167:50958/i | online | malware_download | 2026-09-13 |
hxxp://105.184.11.78:56927/bin.sh | online | malware_download | 2026-09-13 |
hxxp://124.95.45.62:51036/i | online | malware_download | 2026-09-13 |
hxxp://124.95.45.62:51036/bin.sh | online | malware_download | 2026-09-13 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["94.156.166.167", "105.184.11.78", "94.233.15.145", "124.6.169.54", "125.47.114.215", "115.58.121.22", "119.115.144.69", "105.186.143.114", "39.74.115.234", "66.212.187.214", "196.190.10.252", "182.116.48.4", "175.148.71.5", "175.146.5.1", "190.109.227.236", "182.121.59.52", "103.203.210.102", "182.126.119.104", "115.49.232.50", "124.95.45.62", "182.116.116.237"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.156.166.167", "105.184.11.78", "94.233.15.145", "124.6.169.54", "125.47.114.215", "115.58.121.22", "119.115.144.69", "105.186.143.114", "39.74.115.234", "66.212.187.214", "196.190.10.252", "182.116.48.4", "175.148.71.5", "175.146.5.1", "190.109.227.236", "182.121.59.52", "103.203.210.102", "182.126.119.104", "115.49.232.50", "124.95.45.62", "182.116.116.237"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy Application Compatibility Layer (WOW64) Execution: In mixed 64-bit environments, administrators often use Windows On Windows 64 (WOW64) or specific compatibility shims to run legacy 32-bit line-of-business applications (e.g., old ERP clients, specialized CAD tools, or legacy POS systems) that rely on specific 32-bit DLLs or URL handlers. If these applications fetch resources from known but benign 32-bit-specific endpoints (e.g., update servers for old Java JREs or .NET Framework 3.5 components), the URL may match the “32-bit” tag in URLhaus if the domain is shared with malicious actors.
C:\Program Files (x86)\ or C:\Windows\SysWOW64\ that are signed by trusted vendors (e.g., Microsoft Corporation, Oracle Corporation) and have a known Product Name matching legacy software (e.g., “Java(TM) Runtime Environment”, “Adobe Acrobat Reader”).Scheduled Backup or Sync Jobs for 32-bit Client Agents: Many enterprise backup agents (e.g., older versions of Veeam, Commvault, or Symantec Backup Exec) or file sync tools (e.g., older Dropbox for Business, OneDrive for Business 32-bit builds) run as 32-bit services on 64-bit OSes to maintain compatibility with legacy file system hooks. These agents frequently poll specific URLs for license validation, heartbeat checks, or delta syncs. If the URL is listed in URLhaus due to a historical compromise of the vendor’s CDN or a shared IP range, legitimate polling triggers the alert.
svchost.exe (specifically those hosting BackupSvc, `SyncSvc