This hunt targets the execution of 32-bit malicious binaries or payloads delivered via known URLhaus URLs, indicating a potential compromise through legacy or x86-specific software. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and contain active threats that may exploit 32-bit process execution paths before they establish persistence or lateral movement within the environment.
Threat: 32-bit Total URLs: 18 Active URLs: 15
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://220.201.25.49:47541/bin.sh | online | malware_download | 2026-09-02 |
hxxp://95.9.35.137:43208/i | online | malware_download | 2026-09-02 |
hxxp://163.142.93.157:39139/i | online | malware_download | 2026-09-02 |
hxxp://95.9.35.137:43208/bin.sh | online | malware_download | 2026-09-02 |
hxxp://60.19.4.185:54029/i | online | malware_download | 2026-09-02 |
hxxp://219.157.63.238:58386/i | online | malware_download | 2026-09-02 |
hxxp://60.19.4.185:54029/bin.sh | offline | malware_download | 2026-09-02 |
hxxp://219.157.63.238:58386/bin.sh | online | malware_download | 2026-09-02 |
hxxp://123.10.225.139:46476/bin.sh | online | malware_download | 2026-09-02 |
hxxp://196.189.9.27:53134/bin.sh | online | malware_download | 2026-09-02 |
hxxp://59.96.141.7:58981/i | offline | malware_download | 2026-09-02 |
hxxp://125.43.45.149:33353/i | online | malware_download | 2026-09-02 |
hxxp://202.1.26.13:41939/i | online | malware_download | 2026-09-02 |
hxxp://42.233.107.113:43544/i | online | malware_download | 2026-09-02 |
hxxp://182.121.239.171:36990/i | online | malware_download | 2026-09-02 |
hxxp://115.57.254.136:42278/bin.sh | online | malware_download | 2026-09-02 |
hxxp://105.225.107.183:39153/i | offline | malware_download | 2026-09-02 |
hxxp://175.175.22.43:45156/bin.sh | online | malware_download | 2026-09-02 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["95.9.35.137", "220.201.25.49", "182.121.239.171", "115.57.254.136", "219.157.63.238", "123.10.225.139", "196.189.9.27", "125.43.45.149", "60.19.4.185", "175.175.22.43", "163.142.93.157", "202.1.26.13", "42.233.107.113"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["95.9.35.137", "220.201.25.49", "182.121.239.171", "115.57.254.136", "219.157.63.238", "123.10.225.139", "196.189.9.27", "125.43.45.149", "60.19.4.185", "175.175.22.43", "163.142.93.157", "202.1.26.13", "42.233.107.113"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
sapgui.exe, oracmd.exe) and the destination URL matches the specific hash or domain pattern of the flagged URL, provided the connection is over port 80/443 and the user is in a service account group.svchost.exe or the specific agent binary) and exclude if the source process is a known monitoring agent (e.g., zabbix_agent.exe, nagios.exe) and the URL path contains standard telemetry keywords (e.g., /health, /ping, /status).