This detection identifies adversary behavior involving the execution of 32-bit malware payloads delivered through known malicious URLs flagged by URLhaus. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before these legacy threats exploit vulnerabilities in mixed-architecture environments.
Threat: 32-bit Total URLs: 40 Active URLs: 29
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://124.6.169.46:33212/bin.sh | online | malware_download | 2026-08-30 |
hxxp://175.149.67.160:36060/i | online | malware_download | 2026-08-30 |
hxxp://219.154.174.39:60220/i | online | malware_download | 2026-08-30 |
hxxp://182.113.27.187:49881/i | online | malware_download | 2026-08-30 |
hxxp://120.84.213.26:48371/i | online | malware_download | 2026-08-30 |
hxxp://59.97.249.68:48169/i | online | malware_download | 2026-08-30 |
hxxp://182.121.181.105:36990/i | online | malware_download | 2026-08-30 |
hxxp://219.154.174.39:60220/bin.sh | online | malware_download | 2026-08-30 |
hxxp://39.74.2.161:45451/i | online | malware_download | 2026-08-30 |
hxxp://59.97.249.68:48169/bin.sh | offline | malware_download | 2026-08-30 |
hxxp://39.74.2.161:45451/bin.sh | online | malware_download | 2026-08-30 |
hxxp://27.215.215.75:51224/i | online | malware_download | 2026-08-30 |
hxxp://163.142.92.157:40373/i | online | malware_download | 2026-08-30 |
hxxp://163.142.92.157:40373/bin.sh | online | malware_download | 2026-08-30 |
hxxp://182.117.69.14:39814/i | online | malware_download | 2026-08-30 |
hxxp://182.121.41.234:52522/i | online | malware_download | 2026-08-30 |
hxxp://219.157.190.80:41921/i | online | malware_download | 2026-08-30 |
hxxp://182.121.106.206:50819/i | offline | malware_download | 2026-08-30 |
hxxp://182.121.106.206:50819/bin.sh | offline | malware_download | 2026-08-30 |
hxxp://222.219.25.40:41597/bin.sh | online | malware_download | 2026-08-30 |
hxxp://115.58.181.180:33235/i | online | malware_download | 2026-08-30 |
hxxp://196.190.133.180:53984/i | online | malware_download | 2026-08-30 |
hxxp://175.165.141.12:57080/i | offline | malware_download | 2026-08-30 |
hxxp://175.165.141.12:57080/bin.sh | online | malware_download | 2026-08-30 |
hxxp://182.120.132.147:50830/bin.sh | online | malware_download | 2026-08-30 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["120.84.213.26", "112.198.130.112", "182.121.181.105", "219.154.174.39", "163.142.92.157", "59.97.249.68", "196.190.133.180", "113.221.76.194", "182.113.27.187", "112.198.193.62", "182.121.41.234", "222.219.25.40", "219.157.190.80", "115.58.181.180", "182.120.132.147", "175.165.141.12", "115.49.77.192", "39.74.2.161", "124.6.169.46", "113.228.97.87", "115.49.73.224", "182.117.69.14", "175.149.67.160", "27.215.215.75"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["120.84.213.26", "112.198.130.112", "182.121.181.105", "219.154.174.39", "163.142.92.157", "59.97.249.68", "196.190.133.180", "113.221.76.194", "182.113.27.187", "112.198.193.62", "182.121.41.234", "222.219.25.40", "219.157.190.80", "115.58.181.180", "182.120.132.147", "175.165.141.12", "115.49.77.192", "39.74.2.161", "124.6.169.46", "113.228.97.87", "115.49.73.224", "182.117.69.14", "175.149.67.160", "27.215.215.75"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Legacy Line-of-Business (LOB) Application Updates
InventoryApp.exe, LicenseValidator.exe) running under the user context of the application service account (DOMAIN\svc_inventory). Additionally, whitelist the specific destination URLs or IP ranges associated with the vendor’s update server.Microsoft Office 365 ProPlus Background Connectivity
api.office.com, login.microsoftonline.com). If these endpoints are hosted on IP ranges that overlap with URLhaus’s “malicious” tag for 32-bit traffic, the rule triggers.\Program Files (x86)\Microsoft Office\ or specific executables like OUTLOOK.EXE, EXCEL.EXE, and WINWORD.EXE. Ensure the exclusion applies to network destinations matching Microsoft’s known telemetry IP ranges.Antivirus/EDR Definition Updates