This hunt detects adversary behavior involving the execution or access of 32-bit specific malicious web resources identified by URLhaus, which often target legacy applications and older browser configurations within the enterprise network. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify potential compromise vectors that may bypass standard 64-bit focused defenses and prevent lateral movement initiated through outdated client environments.
Threat: 32-bit Total URLs: 28 Active URLs: 26
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://123.13.29.206:45662/i | online | malware_download | 2026-08-04 |
hxxp://182.114.192.237:48636/i | online | malware_download | 2026-08-04 |
hxxp://115.57.15.114:52782/i | online | malware_download | 2026-08-04 |
hxxp://123.13.29.206:45662/bin.sh | online | malware_download | 2026-08-04 |
hxxp://61.52.60.101:38949/i | online | malware_download | 2026-08-04 |
hxxp://219.157.244.162:41098/bin.sh | online | malware_download | 2026-08-04 |
hxxp://182.127.59.25:41880/i | online | malware_download | 2026-08-04 |
hxxp://110.37.61.44:56932/bin.sh | online | malware_download | 2026-08-04 |
hxxp://42.227.3.196:40408/bin.sh | online | malware_download | 2026-08-04 |
hxxp://61.52.60.101:38949/bin.sh | online | malware_download | 2026-08-04 |
hxxp://123.5.178.253:40794/i | online | malware_download | 2026-08-04 |
hxxp://123.5.178.253:40794/bin.sh | online | malware_download | 2026-08-04 |
hxxp://115.63.189.195:55987/i | online | malware_download | 2026-08-04 |
hxxp://113.221.58.195:45339/i | offline | malware_download | 2026-08-04 |
hxxp://112.248.105.19:57268/i | online | malware_download | 2026-08-04 |
hxxp://123.14.220.66:42241/i | online | malware_download | 2026-08-04 |
hxxp://123.14.220.66:42241/bin.sh | online | malware_download | 2026-08-04 |
hxxp://115.61.0.203:49824/i | online | malware_download | 2026-08-04 |
hxxp://112.248.105.19:57268/bin.sh | online | malware_download | 2026-08-04 |
hxxp://222.137.144.217:41848/i | online | malware_download | 2026-08-04 |
hxxp://119.186.204.22:51908/bin.sh | online | malware_download | 2026-08-04 |
hxxp://182.124.127.129:37266/i | online | malware_download | 2026-08-04 |
hxxp://222.137.144.217:41848/bin.sh | online | malware_download | 2026-08-04 |
hxxp://175.165.132.16:50966/i | offline | malware_download | 2026-08-04 |
hxxp://123.8.9.216:53523/i | online | malware_download | 2026-08-04 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["59.96.137.157", "196.189.35.172", "119.186.204.22", "115.63.189.195", "182.114.192.237", "123.8.9.216", "123.13.29.206", "219.157.244.162", "182.127.59.25", "123.5.178.253", "182.124.127.129", "123.14.220.66", "42.227.3.196", "115.57.15.114", "112.248.105.19", "110.37.61.44", "115.61.0.203", "222.137.144.217", "61.52.60.101"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["59.96.137.157", "196.189.35.172", "119.186.204.22", "115.63.189.195", "182.114.192.237", "123.8.9.216", "123.13.29.206", "219.157.244.162", "182.127.59.25", "123.5.178.253", "182.124.127.129", "123.14.220.66", "42.227.3.196", "115.57.15.114", "112.248.105.19", "110.37.61.44", "115.61.0.203", "222.137.144.217", "61.52.60.101"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment:
Legacy Internal Reporting Tools Accessing External Data Sources
NT SERVICE\SQLServerReportingServices) and whitelist the known external API domains used by these tools in the detection logic.Scheduled Maintenance Jobs for Legacy Line-of-Business Applications
01:00–05:00) for specific hostnames associated with known legacy application servers, ensuring the rule only fires during active business hours or when the source process is not one of the whitelined service executables.32-Bit Browser Usage by Administrative Staff