URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving known malicious 32-bit URLs that may indicate compromised endpoints attempting to download or execute legacy payloads within the network. Proactively hunting for these specific indicators in Azure Sentinel is critical because 32-bit resources often represent a higher risk vector for exploitation, requiring immediate isolation and analysis to prevent potential lateral movement or data exfiltration.

IOC Summary

Threat: 32-bit Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["221.15.253.184", "105.184.157.90", "221.15.11.240", "114.221.254.230", "66.8.135.142", "117.146.92.46"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["221.15.253.184", "105.184.157.90", "221.15.11.240", "114.221.254.230", "66.8.135.142", "117.146.92.46"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Legacy Administrative Tooling (e.g., SCCM/ConfigMgr Client)

  • Scenario: The System Center Configuration Manager (SCCM) client on a Windows Server or workstation running 32-bit architecture frequently queries the http://<internal-sccm-server>/sms_client endpoint to download configuration updates. Because many legacy enterprise management tools still rely on 32-bit components, these routine internal HTTP requests can be flagged as “malicious” by URLhaus if the specific hash or domain reputation is not fully indexed for this specific architecture tag.
  • Filter/Exclusion: Exclude traffic originating from the SCCM Client service (ccmexec.exe) where the destination IP falls within the internal corporate subnet (e.g., 10.x.x.x or 192.168.x.x). Alternatively, add a filter to ignore URLs containing /sms_client in the path for 32-bit processes.

• Scheduled Antivirus Definition Updates

  • Scenario: The 32-bit version of Microsoft Defender (or legacy Symantec Endpoint Protection) runs a scheduled job every morning at 06:00 to pull definition updates from http://go.microsoft.com/fwlink/?LinkID=12149. If the URLhaus rule strictly tags this specific update domain as “malicious” due to a temporary reputation issue or a known false positive in the global feed, it triggers an alert for every endpoint running the 32-bit agent.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 05:30–07:30) for traffic generated by MsMpEng.exe or `Symant