This hypothesis targets adversaries leveraging 32-bit malicious URLs to execute payloads or establish command-and-control channels, often exploiting legacy architecture vulnerabilities or specific binary compatibility. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised endpoints or data exfiltration attempts before they escalate, ensuring timely isolation of assets interacting with known malicious web resources.
Threat: 32-bit Total URLs: 47 Active URLs: 37
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://175.148.133.84:52725/i | online | malware_download | 2026-09-11 |
hxxp://115.50.218.143:58288/bin.sh | online | malware_download | 2026-09-11 |
hxxp://175.148.133.84:52725/bin.sh | offline | malware_download | 2026-09-11 |
hxxp://119.165.254.83:53777/i | online | malware_download | 2026-09-11 |
hxxp://196.189.130.28:60910/i | online | malware_download | 2026-09-11 |
hxxp://196.189.130.28:60910/bin.sh | online | malware_download | 2026-09-11 |
hxxp://119.165.254.83:53777/bin.sh | online | malware_download | 2026-09-11 |
hxxp://221.14.171.222:49473/bin.sh | online | malware_download | 2026-09-11 |
hxxp://115.61.243.173:56716/i | online | malware_download | 2026-09-11 |
hxxp://203.177.28.149:58260/i | online | malware_download | 2026-09-11 |
hxxp://112.198.128.164:47005/bin.sh | online | malware_download | 2026-09-11 |
hxxp://203.177.28.149:58260/bin.sh | online | malware_download | 2026-09-11 |
hxxp://116.75.87.176:43639/i | online | malware_download | 2026-09-11 |
hxxp://59.180.144.106:42402/i | offline | malware_download | 2026-09-11 |
hxxp://221.14.173.32:33059/i | offline | malware_download | 2026-09-11 |
hxxp://42.58.171.35:34835/i | online | malware_download | 2026-09-11 |
hxxp://222.127.55.224:47900/i | online | malware_download | 2026-09-11 |
hxxp://222.127.55.224:47900/bin.sh | online | malware_download | 2026-09-11 |
hxxp://119.179.215.67:52251/i | online | malware_download | 2026-09-11 |
hxxp://105.184.213.176:55983/i | offline | malware_download | 2026-09-11 |
hxxp://105.184.213.176:55983/bin.sh | offline | malware_download | 2026-09-11 |
hxxp://42.231.207.203:40714/i | online | malware_download | 2026-09-11 |
hxxp://123.190.27.84:51494/i | online | malware_download | 2026-09-11 |
hxxp://103.171.168.74:33809/bin.sh | online | malware_download | 2026-09-11 |
hxxp://123.190.27.84:51494/bin.sh | online | malware_download | 2026-09-11 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["116.75.87.176", "221.14.171.222", "222.127.55.224", "119.165.254.83", "193.187.101.227", "115.50.218.143", "123.14.221.85", "112.198.128.164", "123.190.27.84", "125.41.169.4", "196.189.130.28", "182.121.181.208", "42.231.207.203", "103.171.168.74", "221.202.103.35", "61.53.87.97", "117.95.20.161", "42.58.171.35", "119.179.215.67", "115.61.243.173", "203.177.28.149", "158.255.83.95", "175.148.133.84"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["116.75.87.176", "221.14.171.222", "222.127.55.224", "119.165.254.83", "193.187.101.227", "115.50.218.143", "123.14.221.85", "112.198.128.164", "123.190.27.84", "125.41.169.4", "196.189.130.28", "182.121.181.208", "42.231.207.203", "103.171.168.74", "221.202.103.35", "61.53.87.97", "117.95.20.161", "42.58.171.35", "119.179.215.67", "115.61.243.173", "203.177.28.149", "158.255.83.95", "175.148.133.84"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy Application Update Checkers: Older 32-bit enterprise applications (e.g., legacy Java-based middleware, old versions of Adobe Acrobat, or specific industrial control system clients) may still reference outdated or deprecated update endpoints that have since been flagged as malicious due to supply chain compromises or abandoned maintenance.
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)) or specific process names (e.g., jre-1.8.0_311\bin\javaw.exe) to the specific URL paths associated with the 32-bit tag.Scheduled Backup or Sync Agents: 32-bit versions of backup agents (e.g., older Veeam, Commvault, or Acronis agents) or file sync tools (e.g., legacy Dropbox or OneDrive for Business 32-bit builds) may poll specific status or configuration URLs that are no longer actively maintained but remain in the URLhaus database due to historical associations.
VeeamBackupSvc.exe, AcronisService.exe) and ensure the destination IP belongs to the vendor’s documented range, excluding generic public IPs if the URL is a known status endpoint.Development and Testing Environments: Developers testing 32-bit compatibility or running legacy CI/CD pipelines (e.g., Jenkins agents on 32-bit Windows nodes) may intentionally access known malicious URLs to verify detection coverage, load testing, or to reproduce bugs in legacy web applications.
Dev, Test, or CI-CD in CM