This detection identifies adversary activity involving 32-bit specific malicious URLs that often target legacy systems or utilize architecture-specific exploits to establish initial access and command-and-control channels. A proactive hunt is essential in Azure Sentinel to uncover potential compromises on older endpoints that may lack modern protection, ensuring early identification of threats that could otherwise evade standard 64-bit focused monitoring.
Threat: 32-bit Total URLs: 33 Active URLs: 31
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://117.26.226.163:59859/bin.sh | online | malware_download | 2026-07-26 |
hxxp://61.52.44.62:58722/bin.sh | online | malware_download | 2026-07-26 |
hxxp://125.166.31.187:48533/bin.sh | online | malware_download | 2026-07-26 |
hxxp://115.54.189.23:55481/i | online | malware_download | 2026-07-26 |
hxxp://39.90.187.50:58528/bin.sh | online | malware_download | 2026-07-26 |
hxxp://115.54.189.23:55481/bin.sh | online | malware_download | 2026-07-26 |
hxxp://60.161.2.82:56389/i | online | malware_download | 2026-07-26 |
hxxp://112.248.155.45:45383/i | online | malware_download | 2026-07-26 |
hxxp://60.161.2.82:56389/bin.sh | online | malware_download | 2026-07-26 |
hxxp://216.126.86.127:58945/i | online | malware_download | 2026-07-26 |
hxxp://221.15.189.92:53997/bin.sh | online | malware_download | 2026-07-26 |
hxxp://27.215.138.98:41527/i | online | malware_download | 2026-07-26 |
hxxp://115.57.74.75:35953/i | online | malware_download | 2026-07-26 |
hxxp://115.57.74.75:35953/bin.sh | online | malware_download | 2026-07-26 |
hxxp://222.134.175.71:46678/i | online | malware_download | 2026-07-26 |
hxxp://222.134.175.71:46678/bin.sh | online | malware_download | 2026-07-26 |
hxxp://123.14.102.112:54726/bin.sh | online | malware_download | 2026-07-26 |
hxxp://115.50.66.149:51699/i | online | malware_download | 2026-07-26 |
hxxp://219.156.105.152:51559/i | online | malware_download | 2026-07-26 |
hxxp://42.178.61.155:32836/i | online | malware_download | 2026-07-26 |
hxxp://115.50.66.149:51699/bin.sh | online | malware_download | 2026-07-26 |
hxxp://42.231.47.59:38421/i | online | malware_download | 2026-07-26 |
hxxp://196.189.198.193:41438/i | offline | malware_download | 2026-07-26 |
hxxp://196.189.198.193:41438/bin.sh | online | malware_download | 2026-07-26 |
hxxp://196.191.137.44:58420/bin.sh | online | malware_download | 2026-07-26 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["39.90.187.50", "115.50.66.149", "125.166.31.187", "42.7.240.14", "61.52.44.62", "216.126.86.127", "123.14.102.112", "196.189.198.193", "42.231.47.59", "42.178.61.155", "27.37.102.120", "60.161.2.82", "115.54.189.23", "27.215.138.98", "196.191.104.40", "117.26.226.163", "221.15.189.92", "115.57.74.75", "112.248.155.45", "105.184.26.87", "196.191.137.44", "219.156.105.152", "222.134.175.71"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.90.187.50", "115.50.66.149", "125.166.31.187", "42.7.240.14", "61.52.44.62", "216.126.86.127", "123.14.102.112", "196.189.198.193", "42.231.47.59", "42.178.61.155", "27.37.102.120", "60.161.2.82", "115.54.189.23", "27.215.138.98", "196.191.104.40", "117.26.226.163", "221.15.189.92", "115.57.74.75", "112.248.155.45", "105.184.26.87", "196.191.137.44", "219.156.105.152", "222.134.175.71"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legacy Admin Tooling via HTTP
Admin-Workstations OU (Organizational Unit) accessing specific internal FQDNs (e.g., *.internal-corp.local) where the protocol is HTTP and the destination IP falls within the corporate DMZ range.Scenario: Scheduled Backup and Reporting Jobs
svc-backup-agent) during their defined maintenance windows (e.g., 01:00–04:00 UTC), filtering out URLs containing known vendor domains like veeam.com, sage.com, or oraclecloud.com.Scenario: Development Environment CI/CD Pipelines