URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the consumption of known 32-bit malicious URLs identified by URLhaus, which often serve as initial infection vectors or command-and-control channels for legacy-based threats. The SOC team should proactively hunt for these indicators in Azure Sentinel to identify potential compromise of older client systems that may lack modern security controls and are frequently targeted by campaigns leveraging 32-bit exploits.

IOC Summary

Threat: 32-bit Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["210.208.110.221", "125.42.30.11", "120.84.212.61", "78.178.118.193", "110.37.119.220", "175.149.65.165"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["210.208.110.221", "125.42.30.11", "120.84.212.61", "78.178.118.193", "110.37.119.220", "175.149.65.165"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, along with targeted filters and exclusions:

• Legacy Patch Management Scans

  • Scenario: The enterprise uses a legacy version of Microsoft System Center Configuration Manager (SCCM) or an older WSUS client running on a 32-bit service account. These agents periodically poll the Microsoft Update servers (go.microsoft.com, download.windowsupdate.com) to fetch patch metadata, which may be tagged as “32-bit” by URLhaus due to the architecture of the endpoint agent rather than the content itself.
  • Filter/Exclusion: Exclude traffic where the source process is ccmsetup.exe or usoc.dll and the destination domain ends in .microsoft.com. Alternatively, create a whitelist for the specific IP ranges of Microsoft Update servers (e.g., 13.107.x.x).

• Automated Backup Agent Heartbeats

  • Scenario: A 32-bit instance of Veeam Backup & Replication or Acronis Cyber Protect is configured to run scheduled jobs that contact the vendor’s cloud portal for license validation and heartbeat checks. The URLhaus signature may flag these specific API endpoints as “malicious” because they are often shared across multiple architectures, but in this context, the traffic represents a legitimate administrative check.
  • Filter/Exclusion: Create an exclusion rule based on the process name VeeamAgent.exe or AcronisBackupService.exe. Additionally, filter out URLs containing specific query parameters like ?action=heartbeat or ?check_license=true.

• 32-bit Browser Plugin Updates

  • Scenario: Users running a 32-bit version of Google Chrome or Mozilla Firefox (common on