URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving access to known 32-bit malicious URLs from the URLhaus threat intelligence feed, signaling potential command and control or initial infection vectors targeting legacy architectures. A proactive hunt is essential in Azure Sentinel to uncover hidden compromises on older systems that may lack modern security controls, ensuring rapid containment of threats leveraging these specific 32-bit indicators.

IOC Summary

Threat: 32-bit Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["101.109.237.184", "120.57.122.56", "103.160.130.109", "112.237.148.180", "112.198.130.112", "42.224.70.52", "222.139.42.27", "221.15.184.239", "103.151.43.183", "123.188.94.210", "83.219.1.198", "219.156.34.146"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["101.109.237.184", "120.57.122.56", "103.160.130.109", "112.237.148.180", "112.198.130.112", "42.224.70.52", "222.139.42.27", "221.15.184.239", "103.151.43.183", "123.188.94.210", "83.219.1.198", "219.156.34.146"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment:

• Legacy Line-of-Business Application Updates

  • Scenario: Older internal applications (e.g., a custom SAP module or legacy inventory system) running on 32-bit architecture often pull update manifests or configuration files from external vendor repositories that are flagged by URLhaus as “potentially malicious” due to shared infrastructure with known malware distribution points.
  • Filter/Exclusion: Create an exclusion rule for specific source FQDNs (e.g., updates.vendor-legacy.com) and limit the scope to 32-bit process paths such as C:\Program Files (x86)\LegacyApp\Updater.exe.

• Scheduled Antivirus Definition Syncs

  • Scenario: The enterprise’s endpoint protection suite (e.g., Microsoft Defender or Symantec Endpoint Protection) utilizes a 32-bit service component to fetch daily definition updates from the vendor’s cloud. These update URLs often contain dynamic query parameters that match the signature of malicious URL patterns.
  • Filter/Exclusion: Exclude traffic originating from known AV service processes (e.g., MsMpEng.exe or SymantecDefender.exe) running in 32-bit mode, specifically targeting destination domains like go.microsoft.com or updates.symantec.com.

• CI/CD Pipeline Artifact Downloads

  • Scenario: Automated build agents (e.g., Jenkins or Azure DevOps) running on 32-bit worker nodes frequently download dependencies, Docker images, or NuGet packages from public registries. These downloads often traverse URLs that URLhaus flags due to high traffic volume and shared hosting with compromised sites.
  • Filter/Exclusion: Implement a filter based on the user agent string