This detection identifies adversary behavior where endpoints access known 32-bit malicious URLs to facilitate initial infection or command and control communication via compromised web traffic. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected hosts and prevent lateral movement before the malware executes its full payload on legacy systems.
Threat: 32-bit Total URLs: 33 Active URLs: 31
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://182.112.187.182:59130/bin.sh | online | malware_download | 2026-07-29 |
hxxp://123.5.128.250:35434/bin.sh | online | malware_download | 2026-07-29 |
hxxp://123.4.237.59:38288/i | online | malware_download | 2026-07-29 |
hxxp://123.14.101.207:44266/i | online | malware_download | 2026-07-29 |
hxxp://124.131.38.18:35909/i | online | malware_download | 2026-07-29 |
hxxp://42.224.193.224:50332/i | online | malware_download | 2026-07-29 |
hxxp://115.63.148.102:52572/bin.sh | online | malware_download | 2026-07-29 |
hxxp://124.131.38.18:35909/bin.sh | offline | malware_download | 2026-07-29 |
hxxp://115.42.71.239:36758/bin.sh | online | malware_download | 2026-07-29 |
hxxp://182.121.215.97:37750/i | online | malware_download | 2026-07-29 |
hxxp://182.121.215.97:37750/bin.sh | online | malware_download | 2026-07-29 |
hxxp://115.55.63.89:54711/i | online | malware_download | 2026-07-29 |
hxxp://110.39.233.38:44583/bin.sh | online | malware_download | 2026-07-29 |
hxxp://115.55.63.89:54711/bin.sh | online | malware_download | 2026-07-29 |
hxxp://182.112.187.182:59130/i | online | malware_download | 2026-07-29 |
hxxp://115.49.72.114:35444/i | online | malware_download | 2026-07-29 |
hxxp://61.176.211.198:50302/i | online | malware_download | 2026-07-29 |
hxxp://216.126.86.75:39675/i | online | malware_download | 2026-07-29 |
hxxp://115.63.149.201:59931/i | online | malware_download | 2026-07-29 |
hxxp://216.126.86.75:39675/bin.sh | online | malware_download | 2026-07-29 |
hxxp://115.51.18.64:37808/i | online | malware_download | 2026-07-29 |
hxxp://113.237.63.22:56535/bin.sh | online | malware_download | 2026-07-29 |
hxxp://115.63.149.201:59931/bin.sh | online | malware_download | 2026-07-29 |
hxxp://115.63.48.100:44388/bin.sh | online | malware_download | 2026-07-29 |
hxxp://182.117.76.246:41138/i | online | malware_download | 2026-07-29 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["216.126.86.75", "182.121.215.97", "115.49.72.114", "112.109.219.55", "182.117.76.246", "115.63.148.102", "115.63.149.201", "105.224.110.80", "123.4.237.59", "124.131.38.18", "115.51.18.64", "182.119.56.112", "113.237.63.22", "42.224.193.224", "123.5.128.250", "115.55.63.89", "123.14.101.207", "182.112.187.182", "115.42.71.239", "61.176.211.198", "123.12.236.117", "110.39.233.38", "115.63.48.100"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["216.126.86.75", "182.121.215.97", "115.49.72.114", "112.109.219.55", "182.117.76.246", "115.63.148.102", "115.63.149.201", "105.224.110.80", "123.4.237.59", "124.131.38.18", "115.51.18.64", "182.119.56.112", "113.237.63.22", "42.224.193.224", "123.5.128.250", "115.55.63.89", "123.14.101.207", "182.112.187.182", "115.42.71.239", "61.176.211.198", "123.12.236.117", "110.39.233.38", "115.63.48.100"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legacy Admin Tool Connectivity
process_name matches known admin tools (e.g., wuaclt.exe, SolarWindsAgent.exe) AND the destination URL belongs to trusted vendor domains (e.g., *.microsoft.com, *.solarwinds.com).Scenario: Scheduled 32-bit Backup and Reporting Jobs
01:00–05:00) where the initiating process is a known scheduled task executable (e.g., VeeamQRT.exe, MsReportServerService.exe) and the destination URL matches a pre-approved list of