← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries leveraging 32-bit malicious URLs to execute payloads or establish command-and-control channels, often exploiting legacy or mixed-architecture environments. Proactively hunting for these indicators in Azure Sentinel is critical to identify potential lateral movement or initial access vectors before they mature into full-blown compromises.

IOC Summary

Threat: 32-bit Total URLs: 2 Active URLs: 1

URLStatusThreatDate Added
hxxp://39.40.158.41:50979/iofflinemalware_download2026-09-09
hxxp://210.208.111.2:34156/ionlinemalware_download2026-09-09

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["210.208.111.2"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["210.208.111.2"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/