URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage known 32-bit malicious URLs to deliver payloads or facilitate command-and-control communications within the network. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises and mitigate potential lateral movement before the threat escalates into a full-blown incident.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["103.31.103.204", "115.56.43.164", "196.190.133.180"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.31.103.204", "115.56.43.164", "196.190.133.180"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment:

• Scenario: Legacy Line-of-Business Application Updates

  • Context: Older internal applications (e.g., a custom inventory system built on .NET Framework 4.0) running as 32-bit services often trigger automatic update checks against vendor endpoints that may be flagged by URLhaus due to shared hosting or generic SSL certificates.
  • Filter/Exclusion: Create an exclusion based on the specific internal hostname or IP range of the legacy application server (e.g., InventoryApp-Server01) and exclude any URLs containing the vendor’s update domain (e.g., *.vendor-updates.com).

• Scenario: Scheduled 32-bit Antivirus Definition Sync

  • Context: The enterprise relies on a specific legacy antivirus agent (e.g., Symantec Endpoint Protection or McAfee Agent) running in 32-bit mode. During nightly scheduled maintenance, the agent contacts the vendor’s definition server to download updates, which URLhaus may classify as “malicious” due to high volume traffic from known update nodes.
  • Filter/Exclusion: Exclude URLs matching the regex pattern for the antivirus vendor’s update domain (e.g., .*\.symantec.com or *.mcafee.com) specifically when the source process is identified as SymCorp.exe or mcagent.exe.

• Scenario: Admin Script Execution via 32-bit PowerShell

  • Context: System administrators frequently run maintenance scripts using the default 32-bit version of PowerShell (powershell.exe located in C:\Windows\System32\WindowsPowerShell\v1.0). When these scripts fetch configuration data or logs from external cloud storage (e.g., Azure Blob Storage or AWS S