This hunt identifies potential compromise vectors by correlating network traffic with a curated list of 32-bit malicious URLs known to host executable payloads or landing pages. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage web-based attacks or drive-by downloads before they progress to lateral movement or data exfiltration.
Threat: 32-bit Total URLs: 45 Active URLs: 33
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://180.190.186.97:52355/i | online | malware_download | 2026-09-04 |
hxxp://115.48.146.57:50353/i | online | malware_download | 2026-09-04 |
hxxp://115.48.146.57:50353/bin.sh | online | malware_download | 2026-09-04 |
hxxp://182.121.216.74:42289/i | online | malware_download | 2026-09-04 |
hxxp://58.65.210.197:57970/i | online | malware_download | 2026-09-04 |
hxxp://182.127.123.120:45115/i | online | malware_download | 2026-09-04 |
hxxp://27.206.202.203:55701/i | online | malware_download | 2026-09-04 |
hxxp://58.65.210.197:57970/bin.sh | online | malware_download | 2026-09-04 |
hxxp://182.127.123.120:45115/bin.sh | online | malware_download | 2026-09-04 |
hxxp://182.121.216.74:42289/bin.sh | online | malware_download | 2026-09-04 |
hxxp://27.206.202.203:55701/bin.sh | online | malware_download | 2026-09-04 |
hxxp://218.29.147.41:58663/i | online | malware_download | 2026-09-04 |
hxxp://182.124.41.251:59176/i | offline | malware_download | 2026-09-04 |
hxxp://182.124.41.251:59176/bin.sh | online | malware_download | 2026-09-04 |
hxxp://42.230.24.16:58927/i | offline | malware_download | 2026-09-04 |
hxxp://125.41.229.38:58416/i | online | malware_download | 2026-09-04 |
hxxp://39.86.247.62:38819/bin.sh | online | malware_download | 2026-09-04 |
hxxp://125.45.49.209:37734/bin.sh | online | malware_download | 2026-09-04 |
hxxp://124.131.133.51:53693/i | offline | malware_download | 2026-09-04 |
hxxp://124.131.133.51:53693/bin.sh | offline | malware_download | 2026-09-04 |
hxxp://125.41.229.38:58416/bin.sh | online | malware_download | 2026-09-04 |
hxxp://218.29.147.41:58663/bin.sh | online | malware_download | 2026-09-04 |
hxxp://105.184.42.145:36337/i | online | malware_download | 2026-09-04 |
hxxp://105.184.42.145:36337/bin.sh | online | malware_download | 2026-09-04 |
hxxp://222.127.158.71:56426/bin.sh | online | malware_download | 2026-09-04 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["105.184.42.145", "125.45.49.209", "115.55.52.180", "180.190.186.97", "182.127.123.120", "27.206.202.203", "218.29.147.41", "222.127.158.71", "182.121.216.74", "115.192.97.236", "27.215.49.38", "115.48.146.57", "120.28.139.121", "182.124.41.251", "125.41.229.38", "58.65.210.197", "39.86.247.62", "60.23.195.26"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["105.184.42.145", "125.45.49.209", "115.55.52.180", "180.190.186.97", "182.127.123.120", "27.206.202.203", "218.29.147.41", "222.127.158.71", "182.121.216.74", "115.192.97.236", "27.215.49.38", "115.48.146.57", "120.28.139.121", "182.124.41.251", "125.41.229.38", "58.65.210.197", "39.86.247.62", "60.23.195.26"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
AcroRd32.exe) when accessing the flagged URL.Nagios, Zabbix, or custom internal agent names).curl.exe 32-bit build or a legacy FTP client) executing a scheduled task to download configuration files or small data chunks from a staging server that has been temporarily associated with a malicious URL in the URLhaus database due to a recent incident.
svc-data-sync) or filter out URLs that match a known internal staging domain pattern (e.g., *.staging.internal.corp).