URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This rule detects potential compromise indicators by identifying traffic to known malicious 32-bit URLs, suggesting an adversary is leveraging legacy or specific architecture-based payloads to establish a foothold or exfiltrate data. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage lateral movement or web-based attacks before they escalate into a broader incident.

IOC Summary

Threat: 32-bit Total URLs: 7 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["123.189.141.170", "115.52.33.146", "59.180.135.43", "42.230.41.157", "222.127.76.40", "123.185.244.205"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.189.141.170", "115.52.33.146", "59.180.135.43", "42.230.41.157", "222.127.76.40", "123.185.244.205"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy 32-bit Java-based inventory management system (e.g., SAP NetWeaver or Oracle EBS) running on Windows Server 2012 R2 executes a scheduled PowerShell script to ping specific API endpoints for license validation or data synchronization. If one of these endpoints is temporarily registered in URLhaus due to a shared IP or certificate issue, the 32-bit powershell.exe or javaw.exe process will trigger the alert.

  • Filter/Exclusion: Exclude alerts where the parent process is javaw.exe or java.exe and the command line contains specific legacy application identifiers (e.g., -Dcom.sun.management.jmxremote or specific SAP/Oracle flags).

• 32-bit Office Add-ins or Plugins: A 32-bit version of Microsoft Office 2016/2019 (common in mixed 32/64-bit environments) loads a third-party PDF editor plugin (e.g., Adobe Acrobat Reader 32-bit) that initiates a connection to a known update server or telemetry endpoint. If that endpoint is flagged in URLhaus, the 32-bit winword.exe or excel.exe process will appear to be accessing a malicious URL.

  • Filter/Exclusion: Exclude alerts where the parent process is a 32-bit Office executable (winword.exe, excel.exe, outlook.exe) and the user agent or command line indicates a known plugin loader (e.g., mshtml.dll or specific COM object registration).

• Legacy .NET Framework Applications: A custom internal line-of-business (LOB) application built on .NET Framework 4.5 (32-bit) uses System.Net.WebClient to fetch configuration files or logs from an internal staging server. If the staging server’s public IP is temporarily listed in URL