URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access known malicious URLs specifically targeting 32-bit architectures, potentially indicating an attempt to exploit legacy systems or deliver tailored payloads. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises on older infrastructure that may lack modern security controls and are often overlooked by standard detection rules.

IOC Summary

Threat: 32-bit Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["45.171.177.193", "123.5.83.209", "223.105.50.190", "42.55.138.2"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.171.177.193", "123.5.83.209", "223.105.50.190", "42.55.138.2"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, tailored for a legitimate enterprise environment:

• Legacy Point-of-Sale (POS) Terminal Updates

  • Scenario: Older retail POS terminals running on Windows XP or embedded Linux often utilize 32-bit browsers to fetch daily price lists and inventory updates from a central cloud repository. These endpoints frequently hit URLs flagged by URLhaus due to the age of their SSL certificates or the nature of the content, triggering the rule despite being benign business operations.
  • Filter/Exclusion: Create an exclusion based on specific hostnames (e.g., *.retail-pos-updates.internal) and restrict the detection to exclude traffic originating from the “Retail-Floor” network segment where these legacy devices reside.

• 32-bit Microsoft Office 365 Click-to-Run Telemetry

  • Scenario: In mixed environments, many users still run the 32-bit version of Microsoft Office (e.g., excel.exe, winword.exe). When these applications perform background telemetry or feature usage reporting to Microsoft’s cloud services, they generate outbound connections that URLhaus may flag as potentially malicious due to the high volume of dynamic URLs generated by the Click-to-Run installation engine.
  • Filter/Exclusion: Exclude traffic where the Process Name matches EXCEL.EXE, WINWORD.EXE, or OUTLOOK.EXE AND the Architecture is identified as 32-bit, provided the destination domain belongs to trusted Microsoft domains (e.g., *.office.com, *.microsoftonline.com).

• Scheduled Antivirus Definition Updates via Legacy Agents

  • Scenario: Enterprise endpoints running legacy versions of antivirus agents (such as older builds of Symantec Endpoint Protection or McAfee) often use 32-bit