URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This rule identifies potentially compromised 32-bit applications or legacy systems that are actively communicating with known malicious URLs, indicating a likely infection or data exfiltration attempt. Proactively hunting for these indicators in Azure Sentinel allows the SOC to isolate affected endpoints before they can be leveraged for lateral movement or further exploitation within the environment.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["123.10.15.71", "42.224.65.22"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.10.15.71", "42.224.65.22"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Deployment via 32-bit Installers: Enterprise IT departments often deploy legacy line-of-business applications (e.g., older versions of Adobe Reader, Java JRE, or specialized industrial control software) that rely on 32-bit .exe or .msi installers hosted on internal file shares or specific vendor CDNs. If the URL path contains a version string like v3.2 or build_32, it may match the “32-bit” heuristic.
  • Filter/Exclusion: Exclude URLs ending in .msi or .exe where the User-Agent is a known enterprise deployment tool (e.g., WUA, SCCM, WSUS) or where the source IP is within the internal 10.0.0.0/8 range.
• Internal API Versioning Endpoints: Modern microservices architectures frequently use URL path segments to denote API versions or architecture compatibility. For example, a request to https://internal-api.corp.com/v3.2/endpoint or https://service.corp.com/api/32bit-compat is a legitimate routing mechanism, not a malicious payload.
  • Filter/Exclusion: Exclude URLs where the domain resolves to an internal CNAME record (e.g., *.corp.com, *.internal.net) and the HTTP response code is 200 or 301, indicating a successful internal service interaction rather than an external download.
• Scheduled Backup and Sync Jobs: Tools like Veeam, Rubrik, or custom PowerShell scripts often sync data to internal storage repositories. If the backup target URL includes a path segment referencing the architecture of the backup agent (e.g., https://backup.corp.com/agent/32bit/submit) or a job ID that happens to contain “32”, it can trigger the