URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where external systems or endpoints access known 32-bit malicious URLs identified by URLhaus to facilitate initial infection or command-and-control communication. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate compromised assets before the malware executes its full payload, thereby reducing dwell time and preventing lateral movement within the network.

IOC Summary

Threat: 32-bit Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["61.53.218.29", "182.124.162.58", "27.215.84.16", "113.228.208.46", "123.14.57.190", "115.55.10.187"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["61.53.218.29", "182.124.162.58", "27.215.84.16", "113.228.208.46", "123.14.57.190", "115.55.10.187"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Line-of-Business (LOB) Application Updates

  • Scenario: Older internal applications (e.g., a custom inventory system built on .NET Framework 4.5 running as a 32-bit service) automatically download configuration patches from a vendor’s public CDN. The URL contains a query string that the rule flags as suspicious due to its structure, even though the traffic is legitimate and encrypted via HTTPS.
  • Filter/Exclusion: Add the specific FQDN of the vendor’s CDN (e.g., cdn.vendor-solutions.com) to the allow-list for this rule, or exclude traffic originating from the specific service account used by the LOB application (e.g., svc-inventory-updater).

• Scheduled 32-bit Backup Agent Jobs

  • Scenario: A widely deployed backup solution like Veeam Backup & Replication or Commvault, running a 32-bit agent service, initiates a scheduled job to fetch the latest virus definition database from the vendor’s repository. The download URL matches the “malicious” signature pattern due to specific path parameters used by the vendor.
  • Filter/Exclusion: Create an exclusion based on the process name of the backup agent (e.g., VeeamAgent.exe or commvault.cmd) and restrict the rule to only trigger if the destination IP is not within the trusted vendor subnet range.

• Microsoft Office 365 Click-to-Run Updates

  • Scenario: The Microsoft Office Click-to-Run service (often running a 32-bit component on mixed-bit environments) periodically contacts office.microsoft.com or update.microsoft.com to check