This hunt targets the execution of 32-bit malicious payloads delivered via known bad URLs, a common vector for initial access and lateral movement in Windows environments. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised hosts before attackers establish persistence or escalate privileges, leveraging the high severity of these specific URLhaus entries to prioritize rapid containment.
Threat: 32-bit Total URLs: 53 Active URLs: 44
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://219.154.175.10:45629/i | online | malware_download | 2026-09-12 |
hxxp://182.121.59.52:33634/i | online | malware_download | 2026-09-12 |
hxxp://101.108.9.4:45355/bin.sh | online | malware_download | 2026-09-12 |
hxxp://114.239.63.214:39292/bin.sh | online | malware_download | 2026-09-12 |
hxxp://175.165.80.115:37534/i | online | malware_download | 2026-09-12 |
hxxp://105.184.158.225:60461/i | online | malware_download | 2026-09-12 |
hxxp://175.165.80.115:37534/bin.sh | online | malware_download | 2026-09-12 |
hxxp://60.23.233.29:57340/i | online | malware_download | 2026-09-12 |
hxxp://88.246.126.132:34502/i | online | malware_download | 2026-09-12 |
hxxp://42.230.29.94:38010/i | online | malware_download | 2026-09-12 |
hxxp://27.207.229.137:52064/i | online | malware_download | 2026-09-12 |
hxxp://88.246.126.132:34502/bin.sh | online | malware_download | 2026-09-12 |
hxxp://123.129.155.156:59122/bin.sh | offline | malware_download | 2026-09-12 |
hxxp://36.70.227.160:36428/i | online | malware_download | 2026-09-12 |
hxxp://115.61.98.163:57147/i | online | malware_download | 2026-09-12 |
hxxp://36.70.227.160:36428/bin.sh | online | malware_download | 2026-09-12 |
hxxp://112.198.130.140:41517/i | online | malware_download | 2026-09-12 |
hxxp://222.127.226.53:46402/bin.sh | online | malware_download | 2026-09-12 |
hxxp://182.119.34.187:44169/i | online | malware_download | 2026-09-12 |
hxxp://115.61.98.163:57147/bin.sh | online | malware_download | 2026-09-12 |
hxxp://182.119.34.187:44169/bin.sh | online | malware_download | 2026-09-12 |
hxxp://222.127.226.53:46402/i | online | malware_download | 2026-09-12 |
hxxp://112.198.130.140:41517/bin.sh | online | malware_download | 2026-09-12 |
hxxp://42.228.46.146:57875/i | online | malware_download | 2026-09-12 |
hxxp://42.228.46.146:57875/bin.sh | online | malware_download | 2026-09-12 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["170.238.123.134", "42.231.94.42", "123.5.170.123", "88.246.126.132", "60.23.233.29", "222.127.226.53", "42.228.46.146", "42.230.29.94", "114.239.63.214", "182.121.59.52", "112.198.130.140", "182.119.34.187", "219.154.175.10", "175.165.80.115", "182.121.208.126", "105.186.82.24", "105.184.158.225", "115.61.98.163", "27.207.229.137", "36.70.227.160", "101.108.9.4"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["170.238.123.134", "42.231.94.42", "123.5.170.123", "88.246.126.132", "60.23.233.29", "222.127.226.53", "42.228.46.146", "42.230.29.94", "114.239.63.214", "182.121.59.52", "112.198.130.140", "182.119.34.187", "219.154.175.10", "175.165.80.115", "182.121.208.126", "105.186.82.24", "105.184.158.225", "115.61.98.163", "27.207.229.137", "36.70.227.160", "101.108.9.4"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
LegacyApp.exe) or the specific process path if the URL is consistently seen in the application’s update manifest.WMI.exe running a 32-bit script, or a 32-bit Sysmon driver helper) sends periodic telemetry to a central logging endpoint that matches the malicious URL pattern due to a generic domain or IP range.
Agent32.exe) when the destination URL matches the known benign internal telemetry endpoint.iexplore.exe or chrome32.exe) if the URL is accessed from a local cache directory or if the request is part of a known cleanup script.