URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This rule identifies potential 32-bit malicious URLs tracked by URLhaus, indicating that an endpoint may be interacting with known malicious web resources to facilitate payload delivery or command-and-control communications. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage web-based threats and isolate affected assets before they progress to more complex post-exploitation activities.

IOC Summary

Threat: 32-bit Total URLs: 14 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["222.138.118.172", "46.16.150.139", "112.198.194.175", "125.47.117.63", "42.235.17.46", "196.191.233.24", "42.228.101.127", "196.190.10.252", "222.141.37.15"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.138.118.172", "46.16.150.139", "112.198.194.175", "125.47.117.63", "42.235.17.46", "196.191.233.24", "42.228.101.127", "196.190.10.252", "222.141.37.15"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Updates via 32-bit Client

  • Scenario: A critical business application (e.g., a legacy ERP or CAD tool) uses a 32-bit update client that downloads patches from a specific, known vendor URL. If that vendor’s domain is temporarily listed on URLhaus due to a shared IP or a minor quirk in the 32-bit client’s user-agent string, the rule triggers.
  • Filter/Exclusion: Allowlist the specific vendor domain (e.g., *.legacy-cad-vendor.com) or exclude processes with the name update32.exe when the destination URL matches the known vendor pattern.

• Scheduled Log Collection by 32-bit Agent

  • Scenario: A 32-bit version of a log collection agent (e.g., splunkforwarder32.exe or arcagent32.exe) is scheduled to upload compressed logs to a specific internal or external endpoint. If the endpoint URL is flagged on URLhaus due to a recent, low-severity report or a shared hosting IP, the rule fires.
  • Filter/Exclusion: Exclude processes with names ending in 32.exe or x86.exe if the destination URL is within the corporate trust zone (e.g., *.internal-corp.net) or if the process is running under a service account (e.g., svc_log_collector).

• Browser Helper Objects (BHOs) or 32-bit Plugins

  • Scenario: A 32-bit browser (e.g., older versions of Internet Explorer or a 32-bit build of Chrome) loads a legitimate plugin or BHO that makes a request to a CDN or telemetry endpoint. If that CDN URL is listed on URLhaus due to a transient issue or a false positive in the 32-bit context