URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the execution of 32-bit malware payloads delivered through known malicious URLs flagged by URLhaus. Proactive hunting in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement before these specific threats can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: 32-bit Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["123.14.85.245", "154.223.128.215"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.14.85.245", "154.223.128.215"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment:

• Scenario: Legacy Line-of-Business (LOB) Application Updates

  • Context: Older internal applications (e.g., a custom inventory system built on .NET Framework 4.5 or a legacy ERP module) running as 32-bit processes often initiate HTTP/HTTPS requests to external update servers or vendor portals that may be flagged by URLhaus due to shared IP reputation issues or lack of modern TLS configurations.
  • Filter/Exclusion: Create an exclusion rule based on the specific process image path and file hash.
    • Example: Exclude if ProcessImageName contains "InventoryApp.exe" AND ProcessArchitecture is 32-bit.

• Scenario: Scheduled Antivirus Definition Syncs

  • Context: Many endpoint protection agents (such as Symantec Endpoint Protection or McAfee) utilize a specific 32-bit service component to download daily definition updates from vendor repositories. These repositories often host thousands of URLs, some of which may be newly added and temporarily flagged by URLhaus before full reputation establishment.
  • Filter/Exclusion: Exclude traffic originating from known antivirus update services during their scheduled maintenance windows (e.g., 02:00–04:00 AM).
    • Example: Exclude if ProcessName is "SymantecUpdateService.exe" AND ScheduledJobID matches "DailyDefSync".

• Scenario: 32-bit Browser Plugins and Extensions

  • Context: In environments where users run 64-bit browsers (like Chrome or Edge) but utilize legacy 32-bit plugins (e.g., Java Web Start, older Adobe PDF viewers, or specific banking security tokens), these plugins often fetch resources from external