This detection rule identifies adversary activity involving known malicious URLs specifically targeting 32-bit architectures, which often indicates an attempt to exploit legacy systems or bypass modern security controls that prioritize 64-bit environments. Proactively hunting for these indicators in Azure Sentinel is critical because 32-bit endpoints frequently represent a high-risk attack surface with fewer native protections, making them prime targets for initial compromise and lateral movement.
Threat: 32-bit Total URLs: 35 Active URLs: 31
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://105.186.64.236:52293/bin.sh | online | malware_download | 2026-07-30 |
hxxp://219.157.11.85:45654/bin.sh | online | malware_download | 2026-07-30 |
hxxp://123.9.220.15:51815/i | online | malware_download | 2026-07-30 |
hxxp://115.48.48.140:59805/i | online | malware_download | 2026-07-30 |
hxxp://115.48.48.140:59805/bin.sh | online | malware_download | 2026-07-30 |
hxxp://125.40.131.1:52924/i | online | malware_download | 2026-07-30 |
hxxp://113.230.197.154:40757/bin.sh | online | malware_download | 2026-07-30 |
hxxp://123.9.220.15:51815/bin.sh | online | malware_download | 2026-07-30 |
hxxp://222.142.250.233:37018/i | online | malware_download | 2026-07-30 |
hxxp://115.49.202.106:57597/i | online | malware_download | 2026-07-30 |
hxxp://125.40.131.1:52924/bin.sh | online | malware_download | 2026-07-30 |
hxxp://39.81.22.56:45205/i | online | malware_download | 2026-07-30 |
hxxp://182.119.60.180:48123/i | online | malware_download | 2026-07-30 |
hxxp://221.15.6.71:56873/i | online | malware_download | 2026-07-30 |
hxxp://182.119.60.180:48123/bin.sh | online | malware_download | 2026-07-30 |
hxxp://221.15.6.71:56873/bin.sh | online | malware_download | 2026-07-30 |
hxxp://182.123.178.196:50097/i | online | malware_download | 2026-07-30 |
hxxp://123.4.238.131:57813/i | online | malware_download | 2026-07-30 |
hxxp://221.15.4.12:49038/i | online | malware_download | 2026-07-30 |
hxxp://182.123.178.196:50097/bin.sh | online | malware_download | 2026-07-30 |
hxxp://196.190.69.149:54241/i | online | malware_download | 2026-07-30 |
hxxp://103.157.210.26:36636/i | online | malware_download | 2026-07-30 |
hxxp://123.9.199.52:50973/i | online | malware_download | 2026-07-30 |
hxxp://221.15.4.12:49038/bin.sh | online | malware_download | 2026-07-30 |
hxxp://164.163.25.149:53018/i | online | malware_download | 2026-07-30 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["115.48.48.140", "182.119.60.180", "125.40.131.1", "105.186.64.236", "123.4.238.131", "115.55.234.204", "110.137.153.25", "123.9.220.15", "164.163.25.149", "103.157.210.26", "221.15.4.12", "196.190.69.149", "219.156.60.143", "182.123.178.196", "123.9.199.52", "113.230.197.154", "39.81.22.56", "219.157.11.85", "222.142.250.233", "221.15.6.71", "115.49.202.106"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.48.48.140", "182.119.60.180", "125.40.131.1", "105.186.64.236", "123.4.238.131", "115.55.234.204", "110.137.153.25", "123.9.220.15", "164.163.25.149", "103.157.210.26", "221.15.4.12", "196.190.69.149", "219.156.60.143", "182.123.178.196", "123.9.199.52", "113.230.197.154", "39.81.22.56", "219.157.11.85", "222.142.250.233", "221.15.6.71", "115.49.202.106"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:
Legacy Admin Tooling on 32-bit Browsers
x86; or WOW64 combined with a whitelist of internal FQDNs (e.g., *.internal.corp, *.admin-portal.com).Scheduled Backup and Sync Jobs
DOMAIN\svc_backup) during known maintenance windows (e.g., 02:00–04:00 UTC) or exclude traffic originating from the backup agent’s executable path (C:\Program Files (x86)\Veeam\...).32-bit Office Add-ins and Macro Services