URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

The detection identifies potential 32-bit malware distribution through malicious URLs linked to known malicious actors, leveraging URLhaus intelligence. SOC teams should proactively hunt for this behavior to disrupt early-stage malware deployment and prevent lateral movement within Azure Sentinel environments.

IOC Summary

Threat: 32-bit Total URLs: 14 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["198.2.100.25", "110.39.231.96", "119.185.241.39", "110.39.255.247", "115.63.146.155", "84.240.11.145", "27.37.101.140", "110.37.53.53", "110.36.65.9", "182.112.36.145", "115.58.171.103", "182.123.194.4"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["198.2.100.25", "110.39.231.96", "119.185.241.39", "110.39.255.247", "115.63.146.155", "84.240.11.145", "27.37.101.140", "110.37.53.53", "110.36.65.9", "182.112.36.145", "115.58.171.103", "182.123.194.4"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate system update or patching process using a 32-bit URL
  Filter/Exclusion: process.name != "wusa.exe" || process.name != "msiexec.exe"
  Explanation: Tools like wusa.exe (Windows Update) or msiexec.exe are commonly used for installing updates and may trigger the rule when accessing known 32-bit URLs during patching.

• Scenario: Scheduled backup job accessing a 32-bit URL for cloud storage
  Filter/Exclusion: process.name != "vssadmin.exe" || process.name != "robocopy.exe"
  Explanation: Backup tools like vssadmin.exe or robocopy.exe may access URLs for cloud storage or backup services, which could be flagged as 32-bit malicious URLs.

• Scenario: Admin task using a 32-bit tool for legacy application support
  Filter/Exclusion: process.name != "msiexec.exe" || process.name != "setup.exe"
  Explanation: Legacy application support tools like msiexec.exe or setup.exe may access 32-bit URLs for compatibility or support, which could be falsely flagged.

• Scenario: Internal tool or script using a 32-bit URL for internal repository access
  Filter/Exclusion: process.name != "powershell.exe" || process.name != "cmd.exe"
  Explanation: Internal scripts or tools running via powershell.exe or cmd.exe may access internal URLs that are mistakenly tagged as malicious in the URLhaus database.

• Scenario: User accessing a 32-bit URL for a known legitimate service (e.g., CDN or API)
  Filter/Exclusion: destination.url contains "cdn.example.com" || destination.url contains "api.example.com"
  Explanation: Leg