URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of 32-bit malicious payloads delivered via known URLhaus entries, indicating an adversary attempting to compromise legacy or mixed-architecture endpoints through direct web-based delivery. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC to identify early-stage intrusions and lateral movement vectors that may evade standard signature-based detections, particularly in environments where 32-bit applications remain prevalent.

IOC Summary

Threat: 32-bit Total URLs: 13 Active URLs: 13

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["182.126.103.229", "119.73.59.113", "61.54.41.118", "115.55.151.48", "42.228.245.61", "101.74.52.251", "182.113.28.110", "123.4.249.119", "115.53.247.98"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.103.229", "119.73.59.113", "61.54.41.118", "115.55.151.48", "42.228.245.61", "101.74.52.251", "182.113.28.110", "123.4.249.119", "115.53.247.98"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Checks: A 32-bit legacy line-of-business application (e.g., an older version of Adobe Reader or a specific ERP client) configured to check for updates or license validation against a known endpoint that has since been flagged by URLhaus due to a compromise or misconfiguration.
  • Filter/Exclusion: Exclude URLs where the User-Agent string contains the specific legacy application name (e.g., Mozilla/5.0 (compatible; LegacyERP/2.0)) or restrict the exclusion to the specific process binary (e.g., LegacyApp32.exe) initiating the request.
• Scheduled Telemetry from 32-bit Agents: A 32-bit version of a monitoring or telemetry agent (e.g., a 32-bit build of Datadog Agent, New Relic, or a custom internal health checker) running on a mixed-architecture server fleet that reports metrics to a staging or legacy endpoint listed in the URLhaus dataset.
  • Filter/Exclusion: Exclude network connections initiated by known service binaries (e.g., telemetry_agent_32.exe or svc_monitor.exe) where the destination port is standard HTTP/HTTPS (80/443) and the URL path matches the expected telemetry endpoint structure (e.g., /api/v1/metrics).
• Browser Cache/History Artifacts: A user’s 32-bit browser instance (e.g., 32-bit Chrome or Firefox) automatically re-requesting a resource from a previously visited malicious or compromised site during a cache validation or prefetching operation, rather than an active user interaction.
  • Filter/Exclusion: Exclude events where the process is a browser executable (e.g., chrome.exe, firefox.exe) and the event type is “Cache Validation” or “Prefetch,” or filter out URLs that have not been actively clicked/