URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the execution of 32-bit malware payloads delivered through known malicious URLs flagged by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to uncover potential lateral movement or initial access attempts that may be missed by standard 64-bit focused monitoring, ensuring comprehensive coverage against legacy architecture threats.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.49.5.250", "42.228.45.167", "222.142.247.129"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.49.5.250", "42.228.45.167", "222.142.247.129"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Legacy Line-of-Business (LOB) Application Updates

  • Scenario: Older internal business applications (e.g., a custom inventory system built on .NET Framework 4.5 running a 32-bit IIS worker process) automatically query external vendor APIs for patch manifests or license validation. These queries often originate from the application server’s specific service account using a 32-bit browser engine or HTTP client library, triggering the rule when accessing known but flagged URLs.
  • Filter/Exclusion: Exclude traffic originating from specific hostnames (e.g., LOB-App-SRV01, Inventory-WEB) and restrict the exclusion to the application’s dedicated Service Account SID (e.g., DOMAIN\svc_inventory_app).

• Scheduled Microsoft Office 365 Pro Plus Connectivity Checks

  • Scenario: The 32-bit version of Microsoft Office (common in mixed-architecture environments) performs periodic connectivity checks and updates via the officeclient.microsoft.com domain. When the background update service (OfficeClickToRun.exe) or the Outlook connector runs as a 32-bit process, it may hit URLs tagged by URLhaus that are benign for this specific client context but flagged generally due to broad reputation data.
  • Filter/Exclusion: Create an exclusion rule for the executable C:\Program Files (x86)\Microsoft Office\root\Office16\* and filter out destination domains ending in .microsoft.com or .office365.com.

• Antivirus Definition Engine Background Scans

  • Scenario: Endpoint protection agents like Symantec Endpoint Protection or McAfee Enterprise often utilize a 32-bit component for