URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of 32-bit malware that communicates with known malicious URLs identified by URLhaus, which often indicates early-stage compromise or lateral movement attempts. A SOC team should proactively hunt for this in Azure Sentinel to rapidly identify and isolate endpoints interacting with these specific threat indicators before they escalate into broader incidents within the organization’s network.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["123.5.171.102", "182.113.251.27", "182.127.168.179"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.5.171.102", "182.113.251.27", "182.127.168.179"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: 32-bit Malicious URLs” Rule

• Legacy Admin Tool Connectivity

  • Scenario: The organization utilizes older 32-bit administrative consoles (e.g., Microsoft System Center Configuration Manager (SCCM) or legacy versions of Splunk Enterprise) that periodically connect to external vendor update servers. These tools often initiate connections to known, trusted URLs hosted on 32-bit endpoints which URLhaus may flag as “malicious” due to shared IP reputation or specific hash signatures associated with the vendor’s distribution network.
  • Filter/Exclusion: Create a rule exception for traffic originating from specific hostnames (e.g., SCCM-Admin01, Splunk-Scheduler) where the destination URL contains the domain suffix of the trusted vendor (e.g., *.microsoft.com or *.splunk.com).

• Scheduled 32-bit Backup and Reporting Agents

  • Scenario: Scheduled jobs running via Windows Task Scheduler execute legacy 32-bit backup agents (such as Veeam Agent for Windows in its older versions) or reporting tools like Crystal Reports. These agents frequently reach out to cloud storage endpoints or licensing servers over HTTPS. If the URLhaus feed has recently updated its threat list based on a new variant, these routine, legitimate connections may be misidentified as malicious 32-bit URLs.
  • Filter/Exclusion: Implement an exclusion based on the process name and scheduled job ID (e.g., VeeamAgent.exe or CrystalReportScheduler) combined with a whitelist of known good destination domains used by these agents.

• Development Environment Build Pipelines

  • Scenario: Internal CI/CD pipelines using Jenkins or TeamCity running on 32-bit build nodes often pull dependencies, documentation, or artifact