This hunt detects adversary behavior involving the execution of 32-bit malware via known malicious URLs identified by URLhaus, which often serve as initial infection vectors or command-and-control channels for legacy-targeted attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises on 32-bit systems and prevent lateral movement before the adversary establishes a persistent foothold.
Threat: 32-bit Total URLs: 50 Active URLs: 39
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://182.127.177.126:47422/i | online | malware_download | 2026-08-14 |
hxxp://110.36.70.28:58014/i | online | malware_download | 2026-08-14 |
hxxp://182.127.177.126:47422/bin.sh | online | malware_download | 2026-08-14 |
hxxp://42.230.18.71:37623/bin.sh | online | malware_download | 2026-08-14 |
hxxp://42.230.18.71:37623/i | online | malware_download | 2026-08-14 |
hxxp://1.58.182.84:51623/bin.sh | online | malware_download | 2026-08-14 |
hxxp://220.192.252.142:56157/i | online | malware_download | 2026-08-14 |
hxxp://179.108.89.220:55094/bin.sh | online | malware_download | 2026-08-14 |
hxxp://222.142.250.250:43654/i | online | malware_download | 2026-08-14 |
hxxp://222.142.250.250:43654/bin.sh | online | malware_download | 2026-08-14 |
hxxp://119.183.3.192:41382/bin.sh | offline | malware_download | 2026-08-14 |
hxxp://96.245.232.233:44492/i | offline | malware_download | 2026-08-14 |
hxxp://115.55.233.2:37781/i | online | malware_download | 2026-08-14 |
hxxp://122.235.157.125:52016/i | online | malware_download | 2026-08-14 |
hxxp://115.55.233.2:37781/bin.sh | online | malware_download | 2026-08-14 |
hxxp://42.178.168.78:33507/i | offline | malware_download | 2026-08-14 |
hxxp://42.178.168.78:33507/bin.sh | online | malware_download | 2026-08-14 |
hxxp://222.141.82.215:49425/i | online | malware_download | 2026-08-14 |
hxxp://118.232.137.101:42009/i | online | malware_download | 2026-08-14 |
hxxp://222.141.82.215:49425/bin.sh | online | malware_download | 2026-08-14 |
hxxp://110.38.221.182:35958/i | online | malware_download | 2026-08-14 |
hxxp://118.232.137.101:42009/bin.sh | online | malware_download | 2026-08-14 |
hxxp://110.38.221.182:35958/bin.sh | online | malware_download | 2026-08-14 |
hxxp://115.49.198.105:41583/bin.sh | online | malware_download | 2026-08-14 |
hxxp://182.121.46.253:58630/i | online | malware_download | 2026-08-14 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["118.232.137.101", "182.127.177.126", "27.215.181.39", "101.109.232.82", "182.113.206.161", "122.235.157.125", "179.108.89.220", "115.55.233.2", "222.141.82.215", "42.178.168.78", "110.38.221.182", "1.58.182.84", "42.230.18.71", "220.192.252.142", "115.49.198.105", "110.36.70.28", "182.116.119.9", "182.121.46.253", "222.142.250.250"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["118.232.137.101", "182.127.177.126", "27.215.181.39", "101.109.232.82", "182.113.206.161", "122.235.157.125", "179.108.89.220", "115.55.233.2", "222.141.82.215", "42.178.168.78", "110.38.221.182", "1.58.182.84", "42.230.18.71", "220.192.252.142", "115.49.198.105", "110.36.70.28", "182.116.119.9", "182.121.46.253", "222.142.250.250"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:
Legacy Line-of-Business (LOB) Application Updates
InventoryApp.exe) or its process ID (PID) range. Alternatively, whitelist the known vendor domains (e.g., *.vendor-portal.com) in the detection logic to bypass URLhaus checks for these specific sources.Scheduled 32-bit Antivirus Definition Syncs
rtvscan.exe or mfevpsvc.exe) to download definition updates. These processes frequently connect to URLhaus-tagged endpoints that may be flagged due to high traffic volume or shared infrastructure, triggering false alerts during the nightly maintenance window (e.g., 02:00 – 04:00).C:\Program Files (x86)\[Vendor Name]\ combined with the known update server IP ranges.