URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging 32-bit malicious URLs to execute payloads or establish command-and-control channels, often exploiting legacy or specific architecture vulnerabilities. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious web traffic before the malicious URLs trigger further lateral movement or data exfiltration.

IOC Summary

Threat: 32-bit Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["42.86.81.207", "181.174.231.21", "115.63.11.34", "222.127.154.221", "125.45.65.90"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.86.81.207", "181.174.231.21", "115.63.11.34", "222.127.154.221", "125.45.65.90"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy 32-bit Application Updates: A specific line-of-business application (e.g., a 32-bit version of Adobe Acrobat Reader or a legacy Java applet) performs an automatic check for updates or license validation against a known URL that has been historically flagged by URLhaus due to a shared infrastructure with a malware campaign.

  • Filter: Exclude the specific user agent string or the specific process name (e.g., AcroRd32.exe or java.exe) when accessing the specific URL path, or create an exclusion for the specific hash of the 32-bit executable if it is a known signed binary.

• Scheduled Backup or Sync Jobs: A 32-bit backup utility (e.g., an older version of Veeam, Acronis, or a custom C# 32-bit sync tool) connects to a remote storage endpoint or metadata service that shares a domain or IP range with a malicious URL from the URLhaus list.

  • Filter: Exclude the specific service account (e.g., svc-backup) or the specific process path (e.g., C:\Program Files (x86)\BackupTool\sync.exe) when the destination URL matches the specific malicious URL, provided the connection is over HTTPS and the certificate is valid.

• Browser Cache or History Cleanup: A 32-bit browser (e.g., Internet Explorer 11 running in 32-bit mode on a 64-bit OS) or a 32-bit cleanup utility (e.g., CCleaner 32-bit) accesses a URL to clear cache, verify plugin compatibility, or fetch a small resource file that happens to be hosted on the same domain as a malicious URL.

  • Filter: Exclude processes associated with browser cache management (e.g., iexplore.exe with specific command-line arguments for cache clearing) or specific