URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity where endpoints access known 32-bit malicious URLs identified by URLhaus, indicating potential initial compromise or command-and-control communication via legacy web traffic. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify and isolate systems interacting with these specific threats before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Threat: 32-bit Total URLs: 15 Active URLs: 15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["42.235.88.72", "59.96.142.198", "59.42.91.193", "42.239.242.122", "222.141.83.246", "115.49.126.243", "61.52.172.186", "113.4.67.131", "222.241.210.219", "115.63.231.224"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.235.88.72", "59.96.142.198", "59.42.91.193", "42.239.242.122", "222.141.83.246", "115.49.126.243", "61.52.172.186", "113.4.67.131", "222.241.210.219", "115.63.231.224"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Legacy Line-of-Business (LOB) Application Updates

  • Scenario: Older internal applications (e.g., a custom inventory system built on .NET Framework 4.5 or a legacy ERP module) running as 32-bit services automatically query external API endpoints or update servers. These legitimate HTTP/HTTPS requests to known vendor domains are flagged because the client process is 32-bit and the URL matches a generic pattern in the Hunt package.
  • Filter/Exclusion: Create an exclusion rule for specific internal FQDNs (e.g., *.internal-apps.corp, update.vendor-erp.com) where the source process name contains known legacy identifiers like LegacyInventory.exe or ERPService32.exe.

• Scheduled 32-bit Antivirus Definition Updates

  • Scenario: The enterprise endpoint protection suite (e.g., Microsoft Defender for Endpoint, Carbon Black, or Symantec) runs a scheduled nightly job to download definition updates. If the update agent component is compiled as a 32-bit executable (mpcmdrun.exe or ccSetMgr.exe) and connects to the vendor’s distribution network, it triggers this rule due to the 32-bit architecture tag on the URL connection.
  • Filter/Exclusion: Exclude traffic originating from specific scheduled tasks (e.g., Microsoft Defender Update Service) connecting to official update domains such as *.go.microsoft.com, *.symantec.com, or *.carbonblack.com.

• 32-bit Office Add-ins and Plugin Connectivity

  • Scenario: Users running 32-bit versions of Microsoft Office (e.g., Outlook 2019 x