URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets the execution of 32-bit malicious binaries or payloads delivered via URLs identified by URLhaus, indicating a potential compromise through legacy architecture exploitation or targeted malware distribution. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage infections or lateral movement attempts before they escalate into significant data exfiltration or ransomware events.

This hunt targets the execution of 32-bit malicious binaries or payloads delivered via URLs identified by URLhaus, indicating a potential compromise through legacy architecture exploitation or targeted malware distribution. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage infections or lateral movement attempts before they escalate into significant data exfiltration or ransomware events.

IOC Summary

Threat: 32-bit Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["123.14.192.80", "170.238.123.135", "113.230.65.104"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.14.192.80", "170.238.123.135", "113.230.65.104"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A 32-bit legacy line-of-business application (e.g., an old Java-based inventory system) performs periodic HTTP GET requests to a known vendor’s status endpoint or update server that is currently flagged in the URLhaus feed due to a recent compromise or shared infrastructure.
  • Filter: Exclude the specific source IP range of the legacy application servers or the specific user-agent string associated with the legacy client (e.g., Java/1.8.0_301) from the URL match condition.
• Scheduled Backup/Validation Jobs: A scheduled Windows Task or cron job on a 32-bit agent host runs a script to validate backup integrity by pinging a specific S3 bucket or internal storage endpoint. If the URL for this endpoint is temporarily listed in the 32-bit malicious URL set (perhaps due to a CDN edge node compromise), the job triggers the alert.
  • Filter: Exclude URLs containing specific path segments associated with internal backup services (e.g., /backup/validate/) or whitelist the specific hostname if it is an internal or trusted vendor domain.
• Third-Party Plugin/SDK Initialization: A 32-bit application (such as an older version of Adobe Reader, a specific CAD tool, or a legacy browser plugin) makes an outbound connection to a telemetry or license verification server during startup. This server’s URL may be shared with other services that have been flagged, causing a false positive.
  • Filter: Exclude the specific process name (e.g., AcroRd32.exe, CADApp.exe) or the specific license/telemetry subdomain (e.g., *.license-check.com) from the URL match.
• Development/Staging Environment Testing: Developers on 32-bit Windows workstations (or VMs) are testing a new feature that involves calling a staging API endpoint.