This hunt detects adversary behavior where attackers leverage known 32-bit malicious URLs to deliver payloads or redirect victims to phishing sites, often exploiting legacy systems that still rely on 32-bit architectures. A SOC team should proactively hunt for these indicators in Azure Sentinel because the high severity of these specific URLhaus entries suggests an active campaign targeting environments with mixed architecture, where 32-bit applications may lack modern security controls and are more susceptible to exploitation.
Threat: 32-bit Total URLs: 29 Active URLs: 25
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://105.186.140.157:48423/bin.sh | online | malware_download | 2026-08-07 |
hxxp://123.4.234.31:58798/i | online | malware_download | 2026-08-07 |
hxxp://124.94.125.230:34268/i | online | malware_download | 2026-08-07 |
hxxp://222.142.223.175:57022/i | online | malware_download | 2026-08-07 |
hxxp://175.151.217.170:55986/i | online | malware_download | 2026-08-07 |
hxxp://182.116.88.229:47375/i | online | malware_download | 2026-08-07 |
hxxp://124.94.116.98:56771/i | online | malware_download | 2026-08-07 |
hxxp://175.151.217.170:55986/bin.sh | online | malware_download | 2026-08-07 |
hxxp://182.116.88.229:47375/bin.sh | online | malware_download | 2026-08-07 |
hxxp://222.142.223.175:57022/bin.sh | online | malware_download | 2026-08-07 |
hxxp://42.239.231.246:37689/i | online | malware_download | 2026-08-07 |
hxxp://42.239.231.246:37689/bin.sh | online | malware_download | 2026-08-07 |
hxxp://115.56.10.15:35093/bin.sh | online | malware_download | 2026-08-07 |
hxxp://115.230.18.121:41849/bin.sh | online | malware_download | 2026-08-07 |
hxxp://115.56.147.12:50068/i | online | malware_download | 2026-08-07 |
hxxp://124.94.125.230:34268/bin.sh | online | malware_download | 2026-08-07 |
hxxp://123.5.148.113:60247/i | online | malware_download | 2026-08-07 |
hxxp://123.5.148.113:60247/bin.sh | online | malware_download | 2026-08-07 |
hxxp://110.36.72.194:41902/i | online | malware_download | 2026-08-07 |
hxxp://110.37.22.216:46217/i | online | malware_download | 2026-08-07 |
hxxp://196.189.98.110:42979/i | offline | malware_download | 2026-08-07 |
hxxp://125.41.8.245:37624/bin.sh | online | malware_download | 2026-08-07 |
hxxp://124.95.24.225:32836/i | online | malware_download | 2026-08-07 |
hxxp://124.95.24.225:32836/bin.sh | online | malware_download | 2026-08-07 |
hxxp://196.189.98.110:42979/bin.sh | offline | malware_download | 2026-08-07 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.230.18.121", "123.4.234.31", "124.94.116.98", "110.36.72.194", "115.56.147.12", "124.95.24.225", "115.56.10.15", "125.41.8.245", "110.37.22.216", "124.94.125.230", "116.59.13.48", "182.116.88.229", "175.151.217.170", "105.186.140.157", "123.5.148.113", "123.129.10.99", "222.142.223.175", "42.239.231.246"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.230.18.121", "123.4.234.31", "124.94.116.98", "110.36.72.194", "115.56.147.12", "124.95.24.225", "115.56.10.15", "125.41.8.245", "110.37.22.216", "124.94.125.230", "116.59.13.48", "182.116.88.229", "175.151.217.170", "105.186.140.157", "123.5.148.113", "123.129.10.99", "222.142.223.175", "42.239.231.246"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including targeted filters and exclusions:
Scenario: Legacy Office Add-ins and COM Object Initialization
WINWORD.EXE, EXCEL.EXE) to maintain compatibility with legacy add-ins. These processes frequently initiate outbound connections to update servers or license validation endpoints that may be flagged by the URLhaus feed due to shared infrastructure or broad categorization.C:\Program Files (x86)\Microsoft Office\* and the user context is a standard office worker, specifically filtering out URLs containing known Microsoft update domains (e.g., *.office.com, *.update.microsoft.com).Scenario: Scheduled Antivirus Definition Updates
Csfalcon.exe (CrowdStrike) or Rtvscan64.exe (Symantec) when they connect to specific vendor update URLs during the defined maintenance window (e.g., 02:00–04:00 local time).Scenario: Legacy Line-of-Business (LOB) Reporting Tools