This hunt targets adversary behavior where compromised systems attempt to communicate with known 32-bit malicious domains identified by URLhaus, indicating potential malware execution or command-and-control activity. Proactively hunting for these specific URLs in Azure Sentinel is critical because it enables the SOC team to identify and isolate early-stage infections before they escalate into broader lateral movement incidents within the network.
Threat: 32-bit Total URLs: 25 Active URLs: 25
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://115.55.168.68:57536/bin.sh | online | malware_download | 2026-06-29 |
hxxp://123.12.21.35:42838/i | online | malware_download | 2026-06-29 |
hxxp://27.44.144.168:43603/bin.sh | online | malware_download | 2026-06-29 |
hxxp://123.12.21.35:42838/bin.sh | online | malware_download | 2026-06-29 |
hxxp://113.237.48.192:40812/i | online | malware_download | 2026-06-29 |
hxxp://182.114.252.213:57272/bin.sh | online | malware_download | 2026-06-29 |
hxxp://182.121.11.158:41632/i | online | malware_download | 2026-06-29 |
hxxp://125.160.139.235:52365/i | online | malware_download | 2026-06-29 |
hxxp://220.167.189.103:48336/i | online | malware_download | 2026-06-29 |
hxxp://220.167.189.103:48336/bin.sh | online | malware_download | 2026-06-29 |
hxxp://182.121.11.158:41632/bin.sh | online | malware_download | 2026-06-29 |
hxxp://113.237.48.192:40812/bin.sh | online | malware_download | 2026-06-29 |
hxxp://61.52.46.195:48072/i | online | malware_download | 2026-06-29 |
hxxp://61.53.75.82:41799/bin.sh | online | malware_download | 2026-06-29 |
hxxp://182.113.1.195:57495/bin.sh | online | malware_download | 2026-06-29 |
hxxp://61.52.46.195:48072/bin.sh | online | malware_download | 2026-06-29 |
hxxp://115.57.237.132:38874/i | online | malware_download | 2026-06-29 |
hxxp://115.57.237.132:38874/bin.sh | online | malware_download | 2026-06-29 |
hxxp://110.39.255.227:51699/bin.sh | online | malware_download | 2026-06-29 |
hxxp://222.137.80.156:43412/bin.sh | online | malware_download | 2026-06-29 |
hxxp://125.41.140.82:40678/bin.sh | online | malware_download | 2026-06-29 |
hxxp://39.79.12.78:40041/i | online | malware_download | 2026-06-29 |
hxxp://39.79.12.78:40041/bin.sh | online | malware_download | 2026-06-29 |
hxxp://123.234.188.68:41568/i | online | malware_download | 2026-06-29 |
hxxp://219.155.239.28:33452/i | online | malware_download | 2026-06-29 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.55.168.68", "219.155.239.28", "113.237.48.192", "123.12.21.35", "27.44.144.168", "125.160.139.235", "182.113.1.195", "115.57.237.132", "61.53.75.82", "222.137.80.156", "39.79.12.78", "182.121.11.158", "182.114.252.213", "123.234.188.68", "110.39.255.227", "220.167.189.103", "61.52.46.195", "125.41.140.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.55.168.68", "219.155.239.28", "113.237.48.192", "123.12.21.35", "27.44.144.168", "125.160.139.235", "182.113.1.195", "115.57.237.132", "61.53.75.82", "222.137.80.156", "39.79.12.78", "182.121.11.158", "182.114.252.213", "123.234.188.68", "110.39.255.227", "220.167.189.103", "61.52.46.195", "125.41.140.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:
Legacy Patch Management Agents (e.g., SCCM/MECM)
ccmexec.exe) and Destination Port (443) for specific internal IP ranges known to host legacy workstations. Alternatively, whitelist the specific URL path containing the update package hash if it appears in the alert details.Scheduled Antivirus Definition Updates via 32-bit Services
svc_antivirus_update) and the Destination Domain matches known vendor CDNs (e.g., *.crowdstrike.com, *.symantec.com). Additionally, filter by time window to only alert