URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets the execution of 32-bit malicious payloads delivered via known bad URLs, indicating an adversary is leveraging legacy architecture to bypass modern security controls or exploit specific binary vulnerabilities. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints before lateral movement occurs, reducing the dwell time of threats that specifically target 32-bit processes.

IOC Summary

Threat: 32-bit Total URLs: 12 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["113.238.102.82", "222.173.239.186", "123.14.245.252", "219.155.28.129", "59.180.143.224", "222.124.53.235", "115.55.229.137", "89.200.227.78", "61.156.171.18", "116.248.81.126", "105.184.253.31"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["113.238.102.82", "222.173.239.186", "123.14.245.252", "219.155.28.129", "59.180.143.224", "222.124.53.235", "115.55.229.137", "89.200.227.78", "61.156.171.18", "116.248.81.126", "105.184.253.31"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Check: A 32-bit line-of-business application (e.g., an older version of Adobe Acrobat or a specific ERP client) configured to check for updates via a hardcoded HTTP URL that happens to be tagged by URLhaus due to a shared hosting IP or a transient false positive.
  • Filter: Exclude processes where ImageFileName matches known legacy 32-bit apps (e.g., AcroRd32.exe, app32.exe) and the URL domain matches the specific whitelisted domain associated with the vendor’s update service.
• Scheduled Telemetry Job: A Windows Task Scheduler job running a 32-bit PowerShell script or batch file to collect telemetry data for a third-party monitoring agent (e.g., Datadog or New Relic agent components) that uses a 32-bit binary to POST data to a staging endpoint.
  • Filter: Exclude events where CommandLine contains powershell.exe or cmd.exe and the parent process is TaskScheduler.exe or svchost.exe, specifically targeting URLs ending in /telemetry or /collect paths.
• Development Environment Testing: A developer testing a 32-bit web service or API integration on a local machine using a staging URL that is shared across multiple dev environments and occasionally flagged by URLhaus due to high traffic or a temporary compromise of the staging server.
  • Filter: Exclude events originating from user accounts with group membership in DevTeam or QA and where the SourceIP is within the internal development subnet range (e.g., 10.20.0.0/16).
• Browser Extension Auto-Update: A 32-bit browser (like 32-bit Chrome or Firefox) running an auto-update check for a specific extension or plugin that communicates with a CDN