URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging known 32-bit malicious web endpoints to deliver payloads or establish command-and-control channels within the organization’s network traffic. Proactively hunting for these specific URL signatures in Azure Sentinel is critical because early identification of these high-severity indicators allows the SOC team to block compromised sessions before they escalate into full-scale infections on legacy systems.

IOC Summary

Threat: 32-bit Total URLs: 15 Active URLs: 15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["119.118.90.115", "60.162.194.130", "110.37.44.250", "39.74.91.180", "42.224.27.77", "196.190.69.149", "110.36.24.140", "60.177.40.254", "123.12.182.213", "105.184.194.116", "182.117.166.24"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["119.118.90.115", "60.162.194.130", "110.37.44.250", "39.74.91.180", "42.224.27.77", "196.190.69.149", "110.36.24.140", "60.177.40.254", "123.12.182.213", "105.184.194.116", "182.117.166.24"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, tailored for a legitimate enterprise environment:

• Legacy Patch Management Scans

  • Scenario: The WSUS (Windows Server Update Services) server or third-party tools like Ivanti Endpoint Manager initiate background scans on older 32-bit client machines. These agents frequently query the Microsoft Update Catalog or vendor-specific update repositories that host legacy 32-bit installer packages, which URLhaus may flag due to high traffic volume or shared IP reputation with known malware distribution points.
  • Filter/Exclusion: Exclude source hosts belonging to the Patch-Management asset group and destination URLs containing paths like /update, /catalog, or specific vendor domains (e.g., *.microsoft.com, *.sccm.microsoft.com) during standard maintenance windows (02:00 – 06:00 UTC).

• Automated Software Deployment via SCCM/MECM

  • Scenario: During scheduled deployment cycles, the System Center Configuration Manager (SCCM) distribution point pushes legacy line-of-business applications to a fleet of 32-bit Point-of-Sale (POS) terminals. These terminals download installation manifests and executable payloads from internal file shares that mirror external content, triggering alerts when the downloaded URLs match known “malicious” signatures used by legitimate software vendors.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from the SCCM-Distribution subnet targeting specific application deployment paths (e.g., /software-deploy/legacy-apps) and restrict the alert to only trigger if the user context is a service account (e.g., svc-sccm-deploy) rather than interactive users.

• Third-Party Antivirus Definition Updates

  • Scenario: Enterprise endpoints running legacy versions