URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where endpoints access known malicious 32-bit URLs, signaling potential initial compromise or lateral movement via compromised web traffic. Proactively hunting for these specific URL patterns in Azure Sentinel is critical to rapidly isolate affected systems and prevent the execution of targeted payloads before they escalate into broader incidents.

IOC Summary

Threat: 32-bit Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["219.157.16.206", "210.208.111.74", "105.184.213.168", "42.239.149.237", "38.46.30.224", "111.163.247.38"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["219.157.16.206", "210.208.111.74", "105.184.213.168", "42.239.149.237", "38.46.30.224", "111.163.247.38"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Legacy Point-of-Sale (POS) System Updates

  • Scenario: Older retail or hospitality POS terminals often run on Windows XP/7 with 32-bit browsers (e.g., Internet Explorer 10/11 or legacy Chrome builds). These systems frequently initiate scheduled updates to vendor portals (e.g., NCR, Micros) that host 32-bit specific download links. The URL structure may match the heuristic for “malicious 32-bit” due to the architecture tag in the request header, even though the traffic is benign.
  • Filter/Exclusion: Create a whitelist exclusion based on the Source Host IP range of the POS network segment and the specific destination domain (e.g., *.ncr.com, *.micros.com). Additionally, exclude traffic where the User-Agent string contains “Windows NT 6.1” or “MSIE 10.0”.

• 32-bit Office Add-in Telemetry

  • Scenario: Enterprise-wide Microsoft Office suites (specifically older versions like Office 2016/2019 running in 32-bit mode) periodically reach out to the office.com or go.microsoft.com domains for add-in telemetry, license validation, and template downloads. The detection logic may flag these specific API endpoints as “malicious 32-bit” because they serve architecture-specific payloads that mimic known malicious patterns.
  • Filter/Exclusion: Exclude URLs containing the path segments /api/v1/telemetry or /update when the source process is EXCEL.EXE, WINWORD.EXE, or OUTLOOK.EXE. Implement a filter to