This hypothesis targets adversaries leveraging 32-bit malicious URLs to execute payloads or establish command-and-control channels, a technique often used to bypass modern 64-bit security controls or exploit legacy application vulnerabilities. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious web traffic before the malicious URLs can facilitate further lateral movement or data exfiltration within the environment.
Threat: 32-bit Total URLs: 52 Active URLs: 39
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://61.52.34.120:58546/bin.sh | online | malware_download | 2026-09-08 |
hxxp://125.44.60.118:38038/i | online | malware_download | 2026-09-08 |
hxxp://119.127.7.102:56002/bin.sh | online | malware_download | 2026-09-08 |
hxxp://125.44.214.233:54441/i | online | malware_download | 2026-09-08 |
hxxp://42.53.134.221:56771/i | online | malware_download | 2026-09-08 |
hxxp://103.19.49.134:36622/i | online | malware_download | 2026-09-08 |
hxxp://115.56.156.211:55186/i | offline | malware_download | 2026-09-08 |
hxxp://115.56.156.211:55186/bin.sh | offline | malware_download | 2026-09-08 |
hxxp://182.127.110.105:38298/i | online | malware_download | 2026-09-08 |
hxxp://182.127.110.105:38298/bin.sh | offline | malware_download | 2026-09-08 |
hxxp://114.198.242.174:38879/i | online | malware_download | 2026-09-08 |
hxxp://182.121.236.181:36990/i | online | malware_download | 2026-09-08 |
hxxp://60.23.235.33:45384/i | online | malware_download | 2026-09-08 |
hxxp://113.228.103.193:40664/i | online | malware_download | 2026-09-08 |
hxxp://60.23.235.33:45384/bin.sh | offline | malware_download | 2026-09-08 |
hxxp://113.228.103.193:40664/bin.sh | online | malware_download | 2026-09-08 |
hxxp://115.62.153.120:40604/i | online | malware_download | 2026-09-08 |
hxxp://42.5.21.40:54382/i | online | malware_download | 2026-09-08 |
hxxp://105.184.177.144:55771/bin.sh | online | malware_download | 2026-09-08 |
hxxp://124.161.116.2:39053/bin.sh | online | malware_download | 2026-09-08 |
hxxp://105.184.177.144:55771/i | online | malware_download | 2026-09-08 |
hxxp://115.62.153.120:40604/bin.sh | online | malware_download | 2026-09-08 |
hxxp://200.115.102.16:53743/bin.sh | online | malware_download | 2026-09-08 |
hxxp://61.137.128.200:54146/i | online | malware_download | 2026-09-08 |
hxxp://59.180.159.200:41778/i | online | malware_download | 2026-09-08 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["60.23.235.33", "114.198.242.174", "115.230.76.101", "218.24.26.58", "222.127.248.61", "103.19.49.134", "42.53.134.221", "182.127.110.105", "105.184.177.144", "182.121.236.181", "60.17.117.82", "113.228.103.193", "124.161.116.2", "182.122.224.155", "200.115.102.16", "115.62.153.120", "42.5.21.40", "115.56.124.86", "59.180.159.200", "125.44.214.233", "125.44.60.118", "61.137.128.200", "119.127.7.102", "61.52.34.120"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["60.23.235.33", "114.198.242.174", "115.230.76.101", "218.24.26.58", "222.127.248.61", "103.19.49.134", "42.53.134.221", "182.127.110.105", "105.184.177.144", "182.121.236.181", "60.17.117.82", "113.228.103.193", "124.161.116.2", "182.122.224.155", "200.115.102.16", "115.62.153.120", "42.5.21.40", "115.56.124.86", "59.180.159.200", "125.44.214.233", "125.44.60.118", "61.137.128.200", "119.127.7.102", "61.52.34.120"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy 32-bit Application Updates: Enterprise applications like older versions of Adobe Acrobat Reader, Java JRE, or specific industrial control system (ICS) software often use 32-bit installers or update mechanisms that may reference URLs tagged as “32-bit” in threat intelligence feeds due to their architecture or historical association with 32-bit exploits.
adobe.com, java.com) and specific installer paths (e.g., /install/, /update/) where the user agent string indicates a known 32-bit browser or application.Scheduled Backup or Sync Jobs: Tools like Veeam, Commvault, or custom PowerShell scripts running on 32-bit agent nodes may poll status endpoints or download configuration files from internal or external servers. If these endpoints are hosted on infrastructure that has been loosely tagged in URLhaus due to a past 32-bit exploit campaign, legitimate polling can trigger the alert.
svc-backup, backup-agent) and restrict the exclusion to specific IP ranges or hostnames associated with backup infrastructure (e.g., *.backup.internal.corp).Legacy Browser Fallbacks: In environments where modern browsers are not fully deployed, users may fall back to 32-bit versions of Internet Explorer or older Chromium builds for compatibility with legacy web apps (e.g., internal HR portals, legacy ERP systems). These browsers may request resources from URLs that URLhaus has tagged based on 32-bit exploit kits, even if the resource itself is benign.
MSIE or Trident (indicating IE) or specific legacy Chromium versions, and limit the exclusion to internal corporate domains (e