This hunt hypothesis targets adversaries leveraging known 32-bit malicious URLs to deliver payloads or establish command-and-control channels that may evade standard detection focused on modern architectures. Proactively hunting for these specific indicators in Azure Sentinel is critical because legacy 32-bit endpoints often lack robust security controls, making them high-value entry points for attackers exploiting outdated software vulnerabilities.
Threat: 32-bit Total URLs: 46 Active URLs: 34
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://125.106.117.223:37160/i | offline | malware_download | 2026-08-26 |
hxxp://112.198.130.112:49065/i | online | malware_download | 2026-08-26 |
hxxp://222.127.76.238:56998/bin.sh | online | malware_download | 2026-08-26 |
hxxp://112.198.130.112:49065/bin.sh | offline | malware_download | 2026-08-26 |
hxxp://115.55.130.247:33094/i | online | malware_download | 2026-08-26 |
hxxp://125.43.231.107:56274/i | online | malware_download | 2026-08-26 |
hxxp://115.55.130.247:33094/bin.sh | online | malware_download | 2026-08-26 |
hxxp://182.113.223.72:49170/i | online | malware_download | 2026-08-26 |
hxxp://182.126.116.139:54641/bin.sh | online | malware_download | 2026-08-26 |
hxxp://182.126.116.139:54641/i | online | malware_download | 2026-08-26 |
hxxp://125.43.231.107:56274/bin.sh | online | malware_download | 2026-08-26 |
hxxp://182.121.114.142:56460/bin.sh | online | malware_download | 2026-08-26 |
hxxp://123.129.133.100:36594/i | online | malware_download | 2026-08-26 |
hxxp://42.230.219.103:55308/bin.sh | online | malware_download | 2026-08-26 |
hxxp://103.172.186.146:38619/i | online | malware_download | 2026-08-26 |
hxxp://123.129.133.100:36594/bin.sh | online | malware_download | 2026-08-26 |
hxxp://103.172.186.146:38619/bin.sh | online | malware_download | 2026-08-26 |
hxxp://115.54.167.76:34845/bin.sh | online | malware_download | 2026-08-26 |
hxxp://222.141.130.234:60443/bin.sh | online | malware_download | 2026-08-26 |
hxxp://189.127.169.20:51301/i | offline | malware_download | 2026-08-26 |
hxxp://221.14.43.98:52883/bin.sh | online | malware_download | 2026-08-26 |
hxxp://189.127.169.20:51301/bin.sh | offline | malware_download | 2026-08-26 |
hxxp://171.233.36.95:43093/i | online | malware_download | 2026-08-26 |
hxxp://180.243.213.31:43447/i | online | malware_download | 2026-08-26 |
hxxp://171.233.36.95:43093/bin.sh | online | malware_download | 2026-08-26 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["163.142.95.49", "115.55.130.247", "221.14.43.98", "49.73.228.85", "180.191.16.206", "182.126.116.139", "125.43.231.107", "182.121.114.142", "42.230.219.103", "222.141.130.234", "182.113.223.72", "112.198.130.112", "171.233.36.95", "61.53.94.34", "115.54.167.76", "182.116.121.1", "180.243.213.31", "123.129.133.100", "103.172.186.146", "115.58.80.179", "95.56.232.109", "115.48.145.152", "222.127.76.238"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["163.142.95.49", "115.55.130.247", "221.14.43.98", "49.73.228.85", "180.191.16.206", "182.126.116.139", "125.43.231.107", "182.121.114.142", "42.230.219.103", "222.141.130.234", "182.113.223.72", "112.198.130.112", "171.233.36.95", "61.53.94.34", "115.54.167.76", "182.116.121.1", "180.243.213.31", "123.129.133.100", "103.172.186.146", "115.58.80.179", "95.56.232.109", "115.48.145.152", "222.127.76.238"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment:
Scenario: Legacy Point-of-Sale (POS) or Inventory Management Systems running on older Windows Server versions often utilize 32-bit browsers (e.g., Internet Explorer 11 or legacy Edge) to query external vendor APIs for real-time stock updates. These systems may frequently access a specific set of 32-bit tagged URLs from suppliers that are flagged as “malicious” by URLhaus due to global reputation issues, despite being trusted within the local network context.
Source IP or Host Name for known legacy POS servers (e.g., POS-Server-01, Inventory-Mgr-DB) and exclude URLs containing specific vendor domains (e.g., *.vendor-supply-chain.com).Scenario: Automated scheduled jobs running via Windows Task Scheduler utilize 32-bit PowerShell scripts or custom C# utilities to fetch daily threat intelligence feeds, weather data, or currency exchange rates from public endpoints. If these scripts run during off-hours and access a URL recently added to the URLhaus 32-bit malicious list (perhaps due to a transient scan error), they will trigger the alert despite performing standard administrative maintenance.
Process Name matching known automation scripts (e.g., powershell.exe, msbuild.exe) running between 02:00 and 04:00 local time, provided the destination URL matches a whitelist of internal data feed domains.Scenario: Administrative workstations used by IT staff often run specialized 32-bit diagnostic tools (such as legacy versions of Wireshark, specific network monitoring agents like SolarWinds NPM, or custom