This detection identifies adversary behavior involving the execution of 32-bit malware payloads delivered through known malicious URLs, which often target legacy systems or specific browser configurations. A SOC team should proactively hunt for these indicators in Azure Sentinel to uncover potential lateral movement or initial access attempts that may evade standard 64-bit focused defenses.
Threat: 32-bit Total URLs: 41 Active URLs: 40
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://115.50.150.5:40794/bin.sh | online | malware_download | 2026-08-11 |
hxxp://221.15.141.166:50250/i | online | malware_download | 2026-08-11 |
hxxp://123.4.178.145:35087/bin.sh | online | malware_download | 2026-08-11 |
hxxp://182.121.138.136:38226/i | online | malware_download | 2026-08-11 |
hxxp://221.15.141.166:50250/bin.sh | online | malware_download | 2026-08-11 |
hxxp://42.224.175.231:41660/bin.sh | online | malware_download | 2026-08-11 |
hxxp://182.121.138.136:38226/bin.sh | online | malware_download | 2026-08-11 |
hxxp://163.142.93.187:39139/i | online | malware_download | 2026-08-11 |
hxxp://175.175.7.234:37031/i | online | malware_download | 2026-08-11 |
hxxp://175.148.158.154:36869/i | online | malware_download | 2026-08-11 |
hxxp://163.142.93.187:39139/bin.sh | online | malware_download | 2026-08-11 |
hxxp://112.251.225.122:36907/i | online | malware_download | 2026-08-11 |
hxxp://125.45.148.93:57695/bin.sh | online | malware_download | 2026-08-11 |
hxxp://175.148.158.154:36869/bin.sh | online | malware_download | 2026-08-11 |
hxxp://222.142.245.198:49568/i | online | malware_download | 2026-08-11 |
hxxp://59.91.206.69:41124/bin.sh | online | malware_download | 2026-08-11 |
hxxp://222.142.245.198:49568/bin.sh | online | malware_download | 2026-08-11 |
hxxp://190.109.228.150:37896/i | online | malware_download | 2026-08-11 |
hxxp://190.109.228.150:37896/bin.sh | online | malware_download | 2026-08-11 |
hxxp://182.117.165.9:33305/i | offline | malware_download | 2026-08-11 |
hxxp://42.227.207.180:58373/i | online | malware_download | 2026-08-11 |
hxxp://42.227.207.180:58373/bin.sh | online | malware_download | 2026-08-11 |
hxxp://175.173.53.215:46519/i | online | malware_download | 2026-08-11 |
hxxp://123.8.45.230:53516/i | online | malware_download | 2026-08-11 |
hxxp://78.25.123.5:48319/i | online | malware_download | 2026-08-11 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["42.224.175.231", "59.91.206.69", "125.45.148.93", "120.84.214.53", "163.142.93.187", "190.109.228.150", "175.148.158.154", "175.173.53.215", "112.251.225.122", "221.15.141.166", "175.175.7.234", "123.8.45.230", "42.227.207.180", "115.50.150.5", "125.41.228.207", "78.25.123.5", "219.155.236.173", "222.142.245.198", "182.121.138.136", "123.4.178.145"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.224.175.231", "59.91.206.69", "125.45.148.93", "120.84.214.53", "163.142.93.187", "190.109.228.150", "175.148.158.154", "175.173.53.215", "112.251.225.122", "221.15.141.166", "175.175.7.234", "123.8.45.230", "42.227.207.180", "115.50.150.5", "125.41.228.207", "78.25.123.5", "219.155.236.173", "222.142.245.198", "182.121.138.136", "123.4.178.145"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate legacy administrative dashboards hosted on internal servers are accessed by administrators using older client applications or browsers that default to 32-bit processes.
admin-portal.internal.corp, sap-gui-reports.local) and the associated internal IP ranges to the rule’s exclusion list, or filter out traffic where the destination port is a known administrative range (e.g., 8443, 9001) combined with a specific User-Agent string indicating an internal admin tool.Scenario: Scheduled automated backup jobs or antivirus scanning agents utilize 32-bit components to fetch configuration updates or threat intelligence feeds from external vendors.
vbrsvc.exe or rtvscan.exe).vbrsvc.exe, rtvscan.exe) and the known external IP addresses of the vendor’s update servers. Alternatively, exclude traffic occurring during the defined maintenance window for these scheduled jobs.Scenario: Deployment of legacy line-of-business applications that rely on 32-bit web components or embedded browsers to validate license keys or sync data with cloud services.