URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets the execution of 32-bit malicious binaries or payloads delivered via known URLhaus URLs, indicating a potential compromise where adversaries leverage legacy architecture to bypass modern 64-bit defenses. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage intrusions or persistent backdoors before they escalate to lateral movement or data exfiltration.

IOC Summary

Threat: 32-bit Total URLs: 13 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["120.28.192.123", "123.11.127.124", "113.230.103.110", "115.48.20.227", "222.142.192.177", "124.161.116.2", "125.42.123.197", "221.15.174.97", "222.127.251.23", "180.252.220.101", "110.81.120.188"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["120.28.192.123", "123.11.127.124", "113.230.103.110", "115.48.20.227", "222.142.192.177", "124.161.116.2", "125.42.123.197", "221.15.174.97", "222.127.251.23", "180.252.220.101", "110.81.120.188"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Checks: A 32-bit Java-based enterprise resource planning (ERP) client or a legacy .NET WinForms application running on a 32-bit OS (e.g., Windows Server 2008 R2) may periodically poll a known vendor endpoint for license validation or update manifests. If the vendor’s CDN or API gateway is hosted on an IP/URL recently flagged by URLhaus due to a transient compromise or shared infrastructure, this legitimate traffic will trigger the alert.

  • Filter/Exclusion: Exclude URLs where the User-Agent string contains specific legacy identifiers (e.g., Java/1.8.0, Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)) AND the destination port is 443 (HTTPS) to reduce noise from plain HTTP legacy checks.

• Scheduled Backup Agent Heartbeats: A 32-bit version of a backup agent (such as an older build of Veeam Endpoint Backup or Acronis True Image) running on a 32-bit workstation or server may send periodic heartbeat packets to a central management console. If the management console’s public-facing URL is temporarily tagged as malicious due to a DDoS mitigation proxy or a CDN edge node compromise, the agent’s routine check-in will appear as malicious URL access.

  • Filter/Exclusion: Exclude URLs accessed by processes with names matching known backup agent binaries (e.g., vcb.exe, trueimage.exe, acronis.exe) AND where the source IP belongs to the internal backup subnet (e.g., 10.20.0.0/24).

• Print Driver or Firmware Update Polling: A 32-bit print spooler service on a Windows Server 2012 R2 machine (running 32-bit drivers for legacy network printers