← Back to SOC feed Coverage →

URLhaus: 32-bit Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-07-24T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving the execution of 32-bit malware payloads delivered through a curated set of known malicious URLs from URLhaus. A SOC team should proactively hunt for this behavior in Azure Sentinel to uncover potential lateral movement or initial access vectors that may evade standard 64-bit focused defenses, ensuring comprehensive coverage against legacy architecture threats.

IOC Summary

Threat: 32-bit Total URLs: 51 Active URLs: 46

URLStatusThreatDate Added
hxxp://98.252.87.232:55884/bin.shonlinemalware_download2026-07-24
hxxp://110.36.2.23:45384/ionlinemalware_download2026-07-24
hxxp://42.239.11.141:53311/ionlinemalware_download2026-07-24
hxxp://182.116.22.120:47264/ionlinemalware_download2026-07-24
hxxp://112.237.236.9:43718/bin.shonlinemalware_download2026-07-24
hxxp://110.36.2.23:45384/bin.shonlinemalware_download2026-07-24
hxxp://39.74.35.191:45301/ionlinemalware_download2026-07-24
hxxp://112.248.187.225:57944/ionlinemalware_download2026-07-24
hxxp://110.36.65.9:53456/ionlinemalware_download2026-07-24
hxxp://42.231.47.185:46513/ionlinemalware_download2026-07-24
hxxp://105.224.82.249:42805/bin.shonlinemalware_download2026-07-24
hxxp://42.231.47.185:46513/bin.shonlinemalware_download2026-07-24
hxxp://182.114.193.246:52583/ionlinemalware_download2026-07-24
hxxp://182.119.0.224:34128/ionlinemalware_download2026-07-24
hxxp://42.224.97.81:43645/ionlinemalware_download2026-07-24
hxxp://42.232.180.224:37072/ionlinemalware_download2026-07-24
hxxp://105.186.187.17:52313/ionlinemalware_download2026-07-24
hxxp://182.119.0.224:34128/bin.shonlinemalware_download2026-07-24
hxxp://110.36.28.230:48902/ionlinemalware_download2026-07-24
hxxp://42.232.180.224:37072/bin.shonlinemalware_download2026-07-24
hxxp://171.83.59.154:46798/ionlinemalware_download2026-07-24
hxxp://105.186.187.17:52313/bin.shonlinemalware_download2026-07-24
hxxp://171.83.59.154:46798/bin.shonlinemalware_download2026-07-24
hxxp://42.239.226.213:55619/ionlinemalware_download2026-07-24
hxxp://110.36.28.230:48902/bin.shonlinemalware_download2026-07-24

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["105.186.187.17", "98.252.87.232", "171.83.59.154", "105.224.82.249", "112.255.63.96", "123.11.73.177", "42.239.11.141", "42.224.97.81", "182.119.0.224", "42.55.37.12", "182.114.193.246", "112.248.187.225", "42.239.226.213", "110.36.2.23", "110.36.65.9", "182.116.22.120", "112.237.236.9", "110.36.28.230", "42.231.47.185", "42.232.180.224", "39.74.35.191"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["105.186.187.17", "98.252.87.232", "171.83.59.154", "105.224.82.249", "112.255.63.96", "123.11.73.177", "42.239.11.141", "42.224.97.81", "182.119.0.224", "42.55.37.12", "182.114.193.246", "112.248.187.225", "42.239.226.213", "110.36.2.23", "110.36.65.9", "182.116.22.120", "112.237.236.9", "110.36.28.230", "42.231.47.185", "42.232.180.224", "39.74.35.191"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/