URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets potential compromise vectors where endpoints or web proxies interact with known malicious URLs associated with 32-bit malware families, indicating active threat actor infrastructure or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage lateral movement or data exfiltration attempts before they escalate into a full-blown incident.

IOC Summary

Threat: 32-bit Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["45.233.94.135", "42.226.216.100", "96.245.232.251", "123.4.40.181"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.233.94.135", "42.226.216.100", "96.245.232.251", "123.4.40.181"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Maintenance: A specific line-of-business application (e.g., a custom .NET 3.5 client or Java 1.6 app) uses a hardcoded, outdated URL for license validation or telemetry that coincidentally matches one of the 5 URLs in the hunt package.
  • Filter/Exclusion: Exclude the specific process name (e.g., LegacyApp.exe) or the parent process if it is a known service host.
• Scheduled Backup/ETL Jobs: A nightly scheduled task (e.g., C:\Scripts\SyncData.ps1 or a SQL Agent job) fetches configuration files or metadata from a staging server that has been temporarily assigned to one of the flagged IP/URL combinations due to internal DNS rebinding or a shared CDN.
  • Filter/Exclusion: Exclude the specific user account (e.g., svc-backup) or the specific script path if the URL is accessed via a known internal proxy or service account.
• Developer Testing Environments: A developer on a non-production workstation is testing a new API integration and manually curls or browses to a staging endpoint that shares the same domain structure or IP as a URLhaus entry, often using tools like curl.exe, PowerShell, or Chrome.exe.
  • Filter/Exclusion: Exclude hosts tagged with Dev or Test in their AD group, or exclude the specific user if they are in the DevTeam security group.
• Third-Party Plugin Updates: A legitimate browser extension or IDE plugin (e.g., a VS Code extension or Chrome extension) checks for updates via a URL that is currently listed on URLhaus due to a transient compromise or misclassification, triggered by the host process (e.g., Code.exe or chrome.exe).
  • Filter/Exclusion: Exclude the specific host process (