This hunt targets adversary behavior where compromised endpoints initiate connections to known 32-bit malicious URLs identified by URLhaus, indicating potential command-and-control communication or malware payload delivery. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of these high-severity threats allows the SOC team to isolate affected 32-bit systems before lateral movement occurs across the network.
Threat: 32-bit Total URLs: 20 Active URLs: 17
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://42.226.69.32:57626/i | online | malware_download | 2026-07-13 |
hxxp://110.37.89.129:36645/i | online | malware_download | 2026-07-13 |
hxxp://27.216.199.130:36784/i | online | malware_download | 2026-07-13 |
hxxp://119.187.249.1:52457/i | online | malware_download | 2026-07-13 |
hxxp://115.61.114.107:37210/i | online | malware_download | 2026-07-13 |
hxxp://105.184.236.156:52227/i | online | malware_download | 2026-07-13 |
hxxp://115.61.114.107:37210/bin.sh | online | malware_download | 2026-07-13 |
hxxp://85.15.119.53:44457/i | online | malware_download | 2026-07-13 |
hxxp://115.54.168.65:34275/bin.sh | online | malware_download | 2026-07-13 |
hxxp://196.189.198.193:36412/i | online | malware_download | 2026-07-13 |
hxxp://42.235.144.196:35570/i | online | malware_download | 2026-07-13 |
hxxp://196.189.198.193:36412/bin.sh | offline | malware_download | 2026-07-13 |
hxxp://77.79.160.210:51525/bin.sh | online | malware_download | 2026-07-13 |
hxxp://42.59.119.187:37559/bin.sh | offline | malware_download | 2026-07-13 |
hxxp://110.37.55.84:51036/i | online | malware_download | 2026-07-13 |
hxxp://124.131.129.41:41802/i | online | malware_download | 2026-07-13 |
hxxp://42.59.119.187:37559/i | offline | malware_download | 2026-07-13 |
hxxp://110.37.55.84:51036/bin.sh | online | malware_download | 2026-07-13 |
hxxp://124.131.129.41:41802/bin.sh | online | malware_download | 2026-07-13 |
hxxp://119.117.244.27:40750/i | online | malware_download | 2026-07-13 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["85.15.119.53", "124.131.129.41", "119.117.244.27", "115.61.114.107", "105.184.236.156", "196.189.198.193", "27.216.199.130", "42.226.69.32", "42.235.144.196", "77.79.160.210", "119.187.249.1", "115.54.168.65", "110.37.55.84", "110.37.89.129"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["85.15.119.53", "124.131.129.41", "119.117.244.27", "115.61.114.107", "105.184.236.156", "196.189.198.193", "27.216.199.130", "42.226.69.32", "42.235.144.196", "77.79.160.210", "119.187.249.1", "115.54.168.65", "110.37.55.84", "110.37.89.129"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are four specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:
Legacy Patch Management Agents on 32-bit Windows Servers
.update.microsoft.com and *.ivanti.com. Additionally, filter out events where the process name matches ccmexec.exe or IvAntiAgent.exe running under a 32-bit architecture context.Scheduled 32-bit Backup Verification Jobs
NT SERVICE\VeeamAgent) or filter by the URL path containing /status or /healthcheck. Implement a time-based exclusion to suppress alerts for these URLs outside of standard business hours if the jobs are strictly off-hours.**32