URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt identifies potential adversary activity by correlating network traffic with known 32-bit malicious URLs from the URLhaus feed, indicating that endpoints may be communicating with compromised or malicious infrastructure. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to detect early-stage compromise or data exfiltration attempts before they escalate into full-blown incidents, particularly targeting legacy or 32-bit applications that may lack modern security controls.

IOC Summary

Threat: 32-bit Total URLs: 11 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.61.189.53", "60.23.238.24", "36.64.184.26", "42.226.67.238", "222.168.180.83", "45.171.177.193", "42.230.190.172", "175.165.82.5", "42.53.235.63", "113.228.155.216"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.61.189.53", "60.23.238.24", "36.64.184.26", "42.226.67.238", "222.168.180.83", "45.171.177.193", "42.230.190.172", "175.165.82.5", "42.53.235.63", "113.228.155.216"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Checks: A 32-bit legacy line-of-business application (e.g., an older version of Adobe Acrobat Reader or a specific ERP client) may be configured to check for updates or license validation against a specific endpoint that has been temporarily flagged by URLhaus due to a shared infrastructure IP or a recent compromise of the vendor’s CDN.

  • Filter/Exclusion: Exclude the specific user-agent string associated with the legacy application (e.g., Mozilla/5.0 (Windows NT 6.1; WOW64) ... [AppName]/[Version]) or whitelist the specific domain if the vendor confirms the URL is legitimate for update checks.

• Scheduled Backup or Sync Jobs: A 32-bit backup agent (e.g., Veeam Agent for Windows 32-bit or a custom PowerShell script running under a 32-bit wscript.exe process) initiates an HTTPS connection to a cloud storage endpoint or a specific SaaS API (e.g., Box, Dropbox, or a private S3 bucket) that URLhaus has tagged as malicious due to a transient issue or a misconfiguration in the vendor’s DNS.

  • Filter/Exclusion: Correlate the process name (wscript.exe, cscript.exe, or the specific backup agent binary) with the parent process being a scheduled task service (Svchost.exe or Taskeng.exe) and exclude connections where the destination port is 443 and the user-agent contains the backup tool’s identifier.

• Browser Plugin or Extension Telemetry: A 32-bit browser (e.g., 32-bit Internet Explorer or an older version of Chrome) running a specific enterprise plugin (e.g., a PDF viewer, a Java applet, or a legacy ActiveX control) sends telemetry or license pings to a third-party analytics or update server that has been recently added