URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the execution of 32-bit malware payloads delivered through five specific malicious URLs flagged by URLhaus. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the threat escalates within the network.

IOC Summary

Threat: 32-bit Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["125.160.188.158", "112.248.114.151", "42.234.204.67", "123.12.198.224"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.160.188.158", "112.248.114.151", "42.234.204.67", "123.12.198.224"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Legacy Admin Tools Accessing Cloud Repositories

  • Scenario: Administrators using legacy 32-bit management consoles (e.g., Microsoft SCCM Client, SolarWinds Orion, or older versions of TeamViewer) often initiate connections to external update servers or cloud repositories. These tools frequently fetch manifests from URLs that URLhaus may flag as “suspicious” due to high traffic volume, even though the content is legitimate software updates.
  • Filter/Exclusion: Create an exclusion for specific source processes known to be 32-bit admin tools.
    • Condition: Process.Name IN ("ccmsetup.exe", "Orion.Agent.exe", "TeamViewer_Service.exe") AND Process.Architecture == x86.

• Automated Patch Management Scheduled Jobs

  • Scenario: Enterprise-wide patch management solutions like WSUS (Windows Server Update Services) or third-party tools such as ManageEngine Desktop Central run scheduled jobs every morning. These 32-bit services query external vendor URLs to download metadata and patch definitions, which can trigger the rule if the vendor’s CDN URL is recently tagged by URLhaus as having mixed reputation signals.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts or during known maintenance windows.
    • Condition: User.Account IN ("svc-patch", "WSUS-Service") AND Event.Time BETWEEN 02:00 AND 06:00.

• 32-bit Browser Extensions and Telemetry

  • Scenario: In environments where users run legacy applications (e.g., older versions of SAP GUI, **Oracle