URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets the execution of 32-bit malicious URLs, a common vector for adversaries leveraging legacy or vulnerable 32-bit applications to establish initial footholds or deliver payloads. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints before lateral movement occurs, particularly in environments where 32-bit binaries remain prevalent.

IOC Summary

Threat: 32-bit Total URLs: 11 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["125.44.215.218", "42.85.187.243", "115.57.251.81", "123.7.237.204", "182.119.160.167", "105.184.248.13", "123.11.9.52"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.44.215.218", "42.85.187.243", "115.57.251.81", "123.7.237.204", "182.119.160.167", "105.184.248.13", "123.11.9.52"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Compatibility Layer (WOW64): Older 32-bit line-of-business applications (e.g., legacy ERP clients or specific CAD tools) may use embedded web controls or browser automation (via Internet Explorer or Chromium Embedded Framework) to fetch configuration files or license validation tokens from known endpoints. If the URL is part of a standard update or check-in process for a 32-bit binary, it will trigger the rule.
  • Filter/Exclusion: Exclude alerts where the parent process is a known 32-bit application binary (e.g., *.exe with MachineType: x86) and the network connection originates from a service account or a specific application service, rather than an interactive user session.
• Scheduled Maintenance Jobs with Hardcoded Endpoints: Enterprise scheduled tasks (e.g., Task Scheduler jobs running as SYSTEM or a service account) for software patching, log aggregation, or backup verification may use 32-bit helper utilities (e.g., cscript.exe, wscript.exe, or custom 32-bit C++ tools) to ping specific status URLs or download small configuration blobs. These URLs are often static and whitelisted in the application’s configuration but not in the SIEM.
  • Filter/Exclusion: Correlate with the CommandLine parameter to check for known maintenance scripts or specific task names (e.g., *PatchCheck*, *BackupVerify*). Exclude if the source process is a script interpreter (wscript.exe, cscript.exe) or a known 32-bit maintenance tool and the destination IP/URL matches a known internal or vendor-specific range.
• Browser Plugin or Extension Update Checks: 32-bit versions of web browsers (e.g., iexplore.exe on 64-bit Windows via WOW64, or older