URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of 32-bit malware delivered through known malicious URLs identified by URLhaus, which often target legacy systems or specific application architectures. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises on 32-bit endpoints that may be overlooked by default 64-bit focused monitoring rules.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["27.44.146.70", "60.23.234.52"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.44.146.70", "60.23.234.52"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Admin Tooling via Browser

  • Scenario: Administrators frequently access legacy on-premise management consoles (e.g., Microsoft System Center Configuration Manager, SAP GUI Frontend Server, or older versions of ServiceNow) using 32-bit browsers like Internet Explorer 11 or specific Chrome Enterprise builds. These tools often rely on embedded 32-bit ActiveX controls or legacy plugins that generate unique, dynamic URLs which URLhaus may flag as “suspicious” due to their non-standard structure and lack of modern HTTPS signatures.
  • Suggested Filter: Create an exclusion based on the User-Agent string containing keywords like MSIE 10.0, Trident/7.0, or specific legacy browser versions, combined with a whitelist of known internal FQDNs (e.g., *.scconfigmgr.local, *.sap-gui.internal).

• Automated Scheduled Reporting Jobs

  • Scenario: Scheduled tasks running on 32-bit Windows Server instances execute nightly reports using tools like PowerShell, Python 3.8 (32-bit), or legacy reporting engines (Crystal Reports). These jobs often fetch data from external analytics platforms or internal APIs via HTTP requests that do not match the standard “modern” URL patterns expected by URLhaus, triggering alerts for every scheduled run at specific times (e.g., 02:00 AM daily).
  • Suggested Filter: Implement a time-based exclusion window (e.g., 01:30 - 04:30) specifically for source IPs belonging to the “Report-Server” subnet, or exclude traffic where the `Process