URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt identifies potential compromise vectors where endpoints interact with known 32-bit malicious URLs, indicating the execution of legacy or architecture-specific malware payloads that may bypass modern 64-bit defenses. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage infections or lateral movement attempts before they escalate into broader network impacts.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["60.19.240.247", "121.234.172.138", "182.122.233.74"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["60.19.240.247", "121.234.172.138", "182.122.233.74"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Compatibility Shims: A 32-bit line-of-business application (e.g., an older version of SAP GUI or a specific ERP client) uses a compatibility shim or wrapper script to fetch configuration files or license keys from a known URL that happens to be tagged in the URLhaus dataset due to a shared IP or domain reputation.
  • Filter/Exclusion: Exclude processes where the parent process is a known 32-bit application executable (e.g., sapgui.exe, erp_client32.exe) or where the command line contains specific arguments like /config or /license.
• Scheduled Maintenance Scripts: A nightly scheduled task (via Windows Task Scheduler) runs a 32-bit PowerShell script or batch file to update a local database or sync logs, which involves an HTTP GET request to a staging server URL that is currently flagged in the URLhaus 32-bit list due to a recent, benign campaign overlap.
  • Filter/Exclusion: Exclude events where the initiating process is svchost.exe (specifically the netsvcs or LocalService group) or powershell.exe with a command line matching known maintenance script paths (e.g., C:\Scripts\Maintenance\sync_db.ps1).
• Developer Testing Environments: A developer on a 32-bit Windows VM or a legacy test bench is manually testing a 32-bit build of a web client or API consumer, intentionally accessing a known test endpoint that is also listed in URLhaus for other malicious campaigns.
  • Filter/Exclusion: Exclude hosts tagged with a specific AD group (e.g., Dev-Test-VMs) or exclude processes where the user context is a known developer account and the process is a browser or test harness (e.g., chrome.exe, test_client32.exe).
• **Third-