This hunt detects adversaries leveraging known 32-bit malicious URLs to deliver payloads or establish command-and-control channels within the network. A SOC team should proactively search for these indicators in Azure Sentinel to identify early-stage compromise attempts that may evade standard perimeter defenses and prevent lateral movement by malicious actors.
Threat: 32-bit Total URLs: 74 Active URLs: 66
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://115.56.174.240:39335/i | online | malware_download | 2026-07-31 |
hxxp://59.97.249.167:40316/bin.sh | online | malware_download | 2026-07-31 |
hxxp://125.47.74.250:45378/i | online | malware_download | 2026-07-31 |
hxxp://175.31.188.203:48322/i | online | malware_download | 2026-07-31 |
hxxp://221.15.187.214:51317/i | online | malware_download | 2026-07-31 |
hxxp://182.121.244.248:50229/i | online | malware_download | 2026-07-31 |
hxxp://182.121.244.248:50229/bin.sh | online | malware_download | 2026-07-31 |
hxxp://125.47.74.250:45378/bin.sh | online | malware_download | 2026-07-31 |
hxxp://42.228.91.217:42496/i | online | malware_download | 2026-07-31 |
hxxp://222.137.25.247:54698/i | online | malware_download | 2026-07-31 |
hxxp://182.117.152.80:55723/i | online | malware_download | 2026-07-31 |
hxxp://115.50.229.76:46799/i | online | malware_download | 2026-07-31 |
hxxp://125.43.38.166:59865/i | online | malware_download | 2026-07-31 |
hxxp://42.228.91.217:42496/bin.sh | online | malware_download | 2026-07-31 |
hxxp://61.53.135.228:56936/i | online | malware_download | 2026-07-31 |
hxxp://196.189.9.233:42853/bin.sh | online | malware_download | 2026-07-31 |
hxxp://105.224.72.150:33723/i | online | malware_download | 2026-07-31 |
hxxp://115.50.229.76:46799/bin.sh | online | malware_download | 2026-07-31 |
hxxp://182.117.152.80:55723/bin.sh | online | malware_download | 2026-07-31 |
hxxp://125.160.208.110:57888/i | online | malware_download | 2026-07-31 |
hxxp://61.53.135.228:56936/bin.sh | online | malware_download | 2026-07-31 |
hxxp://39.74.61.72:46007/bin.sh | online | malware_download | 2026-07-31 |
hxxp://182.113.252.127:47336/i | online | malware_download | 2026-07-31 |
hxxp://125.160.208.110:57888/bin.sh | online | malware_download | 2026-07-31 |
hxxp://177.39.122.214:53607/i | online | malware_download | 2026-07-31 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["125.43.38.166", "42.57.20.156", "61.53.135.228", "59.97.249.167", "115.56.174.240", "222.137.25.247", "177.39.122.214", "221.15.187.214", "182.117.152.80", "196.189.9.233", "182.113.252.127", "125.160.208.110", "42.228.91.217", "125.47.74.250", "115.55.198.142", "115.61.115.0", "105.224.72.150", "39.74.61.72", "175.31.188.203", "115.50.229.76", "83.219.1.198", "182.121.244.248"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.43.38.166", "42.57.20.156", "61.53.135.228", "59.97.249.167", "115.56.174.240", "222.137.25.247", "177.39.122.214", "221.15.187.214", "182.117.152.80", "196.189.9.233", "182.113.252.127", "125.160.208.110", "42.228.91.217", "125.47.74.250", "115.55.198.142", "115.61.115.0", "105.224.72.150", "39.74.61.72", "175.31.188.203", "115.50.229.76", "83.219.1.198", "182.121.244.248"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Legacy Financial Reporting Tool (SAP BusinessObjects)
https://updates.sap.com endpoint to fetch metadata and license validation keys. Because the client agent is strictly 32-bit, these legitimate requests are flagged as matching the “32-bit Malicious URLs” signature due to URL structure similarities with known phishing campaigns.SAP_BI_12.x and whitelist the domain updates.sap.com. Alternatively, filter out traffic originating from the Finance VLAN (e.g., 10.50.40.0/24) where this legacy tool is hosted.Microsoft System Center Configuration Manager (SCCM) Client Updates
https://go.microsoft.com/fwlink/?LinkID=... for patch definitions, the URL often contains parameters that mimic malicious patterns identified by URLhaus, triggering alerts during scheduled maintenance windows (e.g., Tuesday at 2:00 AM).ccmsetup.exe or wuauserv.exe.Adobe Acrobat Pro DC (Legacy PDF Processing)