URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where endpoints access known malicious 32-bit URLs from the URLhaus threat intelligence feed, indicating potential initial compromise or command-and-control activity. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected systems and prevent lateral movement before attackers can exploit legacy 32-bit application vulnerabilities.

IOC Summary

Threat: 32-bit Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.48.37.12", "125.41.72.148", "113.228.208.46", "110.36.75.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.48.37.12", "125.41.72.148", "113.228.208.46", "110.36.75.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including targeted filters and exclusions:

• Legacy Application Updates via Scheduled Tasks

  • Scenario: A legacy line-of-business application (e.g., a custom inventory system built on .NET Framework) runs a daily scheduled task using schtasks.exe to poll a vendor’s update server. The vendor hosts their update manifest on a 32-bit optimized endpoint that URLhaus flags as “suspicious” due to low reputation, despite being a trusted partner.
  • Filter/Exclusion: Create an exclusion for the specific scheduled task name (e.g., LegacyInventoryUpdate) and exclude the vendor’s domain (e.g., updates.trusted-vendor.com) from the URLhaus 32-bit tag logic if the source process is a known service account.

• Microsoft Office Click-to-Run Background Telemetry

  • Scenario: The Microsoft Office Click-to-Run installation (OfficeClickToRun.exe) initiates background telemetry and license validation calls to office.microsoft.com. Since many Office components run as 32-bit processes even on 64-bit OS, these legitimate health check URLs are frequently tagged by URLhaus as potential 32-bit malicious vectors.
  • Filter/Exclusion: Exclude the process path C:\Program Files\Microsoft Office\root\Office16\ and filter out any URL containing office.microsoft.com or go.microsoft.com when the initiating process is identified as a Microsoft-signed executable.

• Antivirus Definition Updates (32-bit Components)

  • Scenario: Enterprise Endpoint Protection suites like Symantec Endpoint Protection or McAfee often utilize 32-bit helper processes to download definition updates from their cloud repositories. These downloads trigger the rule because the connection originates from a