This detection rule identifies adversary activity involving the execution or access of known 32-bit malicious URLs, which often serve as initial entry points for targeted attacks on legacy systems. A proactive hunt in Azure Sentinel is essential to uncover potential lateral movement or data exfiltration attempts that may bypass standard perimeter defenses by leveraging these specific 32-bit indicators.
Threat: 32-bit Total URLs: 26 Active URLs: 26
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://115.49.240.130:34325/bin.sh | online | malware_download | 2026-08-05 |
hxxp://115.55.115.96:44003/i | online | malware_download | 2026-08-05 |
hxxp://182.113.250.40:55617/i | online | malware_download | 2026-08-05 |
hxxp://222.141.74.228:46205/i | online | malware_download | 2026-08-05 |
hxxp://115.51.95.76:57996/bin.sh | online | malware_download | 2026-08-05 |
hxxp://123.5.126.137:60939/i | online | malware_download | 2026-08-05 |
hxxp://125.44.60.121:45542/i | online | malware_download | 2026-08-05 |
hxxp://123.5.126.137:60939/bin.sh | online | malware_download | 2026-08-05 |
hxxp://115.49.131.148:60155/bin.sh | online | malware_download | 2026-08-05 |
hxxp://125.44.60.121:45542/bin.sh | online | malware_download | 2026-08-05 |
hxxp://101.109.170.235:45360/i | online | malware_download | 2026-08-05 |
hxxp://175.9.132.112:50484/i | online | malware_download | 2026-08-05 |
hxxp://182.119.57.28:48123/i | online | malware_download | 2026-08-05 |
hxxp://182.119.34.47:58607/i | online | malware_download | 2026-08-05 |
hxxp://42.85.239.3:46645/i | online | malware_download | 2026-08-05 |
hxxp://175.9.132.112:50484/bin.sh | online | malware_download | 2026-08-05 |
hxxp://101.109.170.235:45360/bin.sh | online | malware_download | 2026-08-05 |
hxxp://182.119.34.47:58607/bin.sh | online | malware_download | 2026-08-05 |
hxxp://182.119.57.28:48123/bin.sh | online | malware_download | 2026-08-05 |
hxxp://119.179.214.25:35406/i | online | malware_download | 2026-08-05 |
hxxp://120.84.213.43:39139/i | online | malware_download | 2026-08-05 |
hxxp://42.230.71.230:39489/i | online | malware_download | 2026-08-05 |
hxxp://182.121.181.242:39984/i | online | malware_download | 2026-08-05 |
hxxp://42.230.71.230:39489/bin.sh | online | malware_download | 2026-08-05 |
hxxp://42.86.120.110:36469/i | online | malware_download | 2026-08-05 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["175.9.132.112", "182.121.181.242", "115.49.131.148", "182.119.57.28", "182.113.250.40", "182.119.34.47", "115.49.240.130", "123.5.126.137", "101.109.170.235", "42.85.239.3", "222.141.74.228", "120.84.213.43", "115.55.115.96", "42.86.120.110", "115.51.95.76", "125.44.60.121", "119.179.214.25", "42.230.71.230"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["175.9.132.112", "182.121.181.242", "115.49.131.148", "182.119.57.28", "182.113.250.40", "182.119.34.47", "115.49.240.130", "123.5.126.137", "101.109.170.235", "42.85.239.3", "222.141.74.228", "120.84.213.43", "115.55.115.96", "42.86.120.110", "115.51.95.76", "125.44.60.121", "119.179.214.25", "42.230.71.230"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy Admin Tooling & Patch Management
10.x.x.x for SCCM) and whitelist the known vendor update domains (e.g., *.microsoft.com, *.solarwinds.com) within the detection logic.Scheduled Backup & Reporting Jobs
01:00–05:00 local time) combined with an entity filter that excludes processes matching known backup service names (e.g., VeeamAgent.exe, AcronisBackupService) from triggering the alert.32-Bit Development & CI/CD Pipelines