URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving the execution of 32-bit malware payloads delivered through known malicious URLs identified by URLhaus. A SOC team should proactively investigate these indicators in Azure Sentinel to identify potential lateral movement or initial access attempts that may be missed by standard detection rules focusing primarily on 64-bit architectures.

IOC Summary

Threat: 32-bit Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["27.202.209.142", "42.224.21.119"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.202.209.142", "42.224.21.119"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy 32-bit administrative tool (e.g., Microsoft System Center Configuration Manager or SolarWinds Server & Application Monitor) initiates a background update check against the vendor’s official repository. The tool runs as a 32-bit process and queries a known URL that has been recently flagged by URLhaus due to a transient false positive on the vendor’s CDN edge node.

  • Filter/Exclusion: Create an exclusion rule for the specific executable hash or path (e.g., C:\Program Files (x86)\SCCM\Updates.exe) targeting the known benign domain (e.g., *.microsoft.com or *.solarwinds.com). Alternatively, add the URL to a “Trusted Sources” allow-list within the detection logic.

• Scenario: A scheduled nightly backup job utilizing a 32-bit client agent (such as Veeam Backup & Replication running in compatibility mode) attempts to download a large configuration manifest or license renewal file from the vendor’s portal. The URL is tagged as malicious by URLhaus because it hosts dynamic content that occasionally triggers heuristic alerts, despite being part of standard operational maintenance.

  • Filter/Exclusion: Implement a time-based exclusion for the specific scheduled task (e.g., VeeamBackupService) during its defined execution window (e.g., 02:00–04:00 daily). Additionally, exclude traffic from the backup service’s IP address range if the detection logic supports network-layer filtering.

• Scenario: An internal legacy reporting dashboard built on a 32-bit version of Internet Information Services (IIS) pulls real-time market data via an API endpoint hosted on a third-party financial data provider. The URL is flagged because the provider recently updated their SSL certificate chain or IP rotation, causing URLhaus to temporarily classify it as suspicious before full propagation.