This detection rule identifies adversary activity involving known 32-bit malicious URLs from URLhaus, which often serve as initial infection vectors or command-and-control channels for legacy-targeted threats. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malware establishes a persistent foothold within the network.
Threat: 32-bit Total URLs: 30 Active URLs: 30
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://110.37.5.157:59057/i | online | malware_download | 2026-07-22 |
hxxp://125.44.25.79:50502/i | online | malware_download | 2026-07-22 |
hxxp://74.83.48.109:2399/i | online | malware_download | 2026-07-22 |
hxxp://36.25.99.85:60395/bin.sh | online | malware_download | 2026-07-22 |
hxxp://42.227.203.231:60823/i | online | malware_download | 2026-07-22 |
hxxp://182.119.70.155:46103/i | online | malware_download | 2026-07-22 |
hxxp://110.37.5.157:59057/bin.sh | online | malware_download | 2026-07-22 |
hxxp://219.157.233.184:51727/bin.sh | online | malware_download | 2026-07-22 |
hxxp://112.231.204.207:49619/i | online | malware_download | 2026-07-22 |
hxxp://182.119.70.155:46103/bin.sh | online | malware_download | 2026-07-22 |
hxxp://42.227.203.231:60823/bin.sh | online | malware_download | 2026-07-22 |
hxxp://110.38.211.139:33957/bin.sh | online | malware_download | 2026-07-22 |
hxxp://27.193.169.9:35982/i | online | malware_download | 2026-07-22 |
hxxp://182.127.114.53:34892/i | online | malware_download | 2026-07-22 |
hxxp://125.44.25.79:50502/bin.sh | online | malware_download | 2026-07-22 |
hxxp://182.127.114.53:34892/bin.sh | online | malware_download | 2026-07-22 |
hxxp://27.44.146.217:51284/i | online | malware_download | 2026-07-22 |
hxxp://46.236.65.23:60207/bin.sh | online | malware_download | 2026-07-22 |
hxxp://123.11.10.161:47124/i | online | malware_download | 2026-07-22 |
hxxp://42.224.191.38:50966/bin.sh | online | malware_download | 2026-07-22 |
hxxp://182.121.156.49:45012/i | online | malware_download | 2026-07-22 |
hxxp://110.37.127.45:35628/i | online | malware_download | 2026-07-22 |
hxxp://196.190.11.194:47920/bin.sh | online | malware_download | 2026-07-22 |
hxxp://160.22.106.17/release/arm | online | malware_download | 2026-07-22 |
hxxp://115.58.251.134:37255/i | online | malware_download | 2026-07-22 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["36.25.99.85", "110.37.5.157", "105.225.189.37", "42.224.191.38", "125.44.25.79", "27.193.169.9", "160.22.106.17", "110.38.211.139", "182.127.114.53", "113.239.94.123", "163.142.92.229", "110.37.127.45", "182.121.156.49", "42.227.203.231", "112.231.204.207", "74.83.48.109", "123.11.10.161", "27.44.146.217", "219.157.233.184", "46.236.65.23", "182.119.70.155", "115.58.251.134", "196.190.11.194"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["36.25.99.85", "110.37.5.157", "105.225.189.37", "42.224.191.38", "125.44.25.79", "27.193.169.9", "160.22.106.17", "110.38.211.139", "182.127.114.53", "113.239.94.123", "163.142.92.229", "110.37.127.45", "182.121.156.49", "42.227.203.231", "112.231.204.207", "74.83.48.109", "123.11.10.161", "27.44.146.217", "219.157.233.184", "46.236.65.23", "182.119.70.155", "115.58.251.134", "196.190.11.194"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, along with targeted filters and exclusions:
Legacy Admin Tool Execution via Scheduled Task
SYSTEM account or a specific service account (svc_admin) every morning at 06:00 AM. Because the underlying browser component or the client agent executing the request is 32-bit, it generates traffic to the dashboard’s update endpoint which URLhaus flags as “Malicious” due to a high volume of requests from a single IP range often associated with known malware distribution networks.svc_admin) and destination domain (admin.internal.corp.com), or exclude traffic originating from the specific host ID where the legacy tool is installed during the scheduled window (05:55–06:15).Antivirus Definition Updates via 32-bit Client
*.symantec.com, *.mcafee.com) when the source process is identified as the antivirus updater service (e.g., SymantecDefender.exe or McAgent.exe).**3