URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

Hunt package for 46 malicious URLs tagged as 32-bit

IOC Summary

Threat: 32-bit Total URLs: 46 Active URLs: 42

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["39.74.235.15", "117.205.90.155", "115.48.151.224", "222.140.160.89", "110.37.45.161", "42.227.197.21", "182.117.160.77", "175.165.80.253", "110.37.97.71", "42.234.72.238", "117.223.140.8", "117.235.117.8", "79.24.141.59", "115.55.246.34", "82.144.86.37", "110.37.55.92", "27.37.100.58", "222.139.108.152", "222.140.179.126", "59.183.118.33", "123.13.103.228"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.74.235.15", "117.205.90.155", "115.48.151.224", "222.140.160.89", "110.37.45.161", "42.227.197.21", "182.117.160.77", "175.165.80.253", "110.37.97.71", "42.234.72.238", "117.223.140.8", "117.235.117.8", "79.24.141.59", "115.55.246.34", "82.144.86.37", "110.37.55.92", "27.37.100.58", "222.139.108.152", "222.140.179.126", "59.183.118.33", "123.13.103.228"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus