URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of 32-bit malicious payloads delivered via known URLhaus entries, indicating an adversary is actively deploying architecture-specific malware to compromise endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate affected hosts before the 32-bit binaries can establish persistence or lateral movement within the environment.

IOC Summary

Threat: 32-bit Total URLs: 7 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["112.252.198.182", "115.56.159.3", "42.234.154.101", "182.120.148.13"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.252.198.182", "115.56.159.3", "42.234.154.101", "182.120.148.13"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A 32-bit legacy line-of-business application (e.g., an older Java-based ERP client or a specific POS system) performs automated integrity checks or license validation against a known endpoint that has been recently flagged by URLhaus due to a shared IP or domain compromise.
  • Filter: Exclude the specific user agent string associated with the legacy app (e.g., Mozilla/5.0 (Windows NT 6.1; WOW64) LegacyApp/2.1) or whitelist the specific hash of the 32-bit executable if it is signed by a trusted internal CA.
• Scheduled Backup Verification Jobs: A 32-bit backup utility (e.g., an older version of Veeam Agent or Acronis True Image) runs a scheduled task to verify backup repository integrity by pinging a specific monitoring URL or API endpoint that coincides with the malicious URL pattern.
  • Filter: Correlate the alert with the scheduled task name (e.g., BackupIntegrityCheck) and exclude if the process is running under a dedicated service account (e.g., svc-backup) with a known PID range.
• 32-bit Browser Plugin/Extension Updates: A 32-bit version of a browser (e.g., 32-bit Internet Explorer or a legacy Chromium build) attempts to update a specific plugin or extension (e.g., a PDF reader or Java applet) from a distribution server that has been tagged as malicious due to a supply chain issue.
  • Filter: Exclude if the parent process is a known 32-bit browser executable (e.g., iexplore.exe or chrome32.exe) and the URL matches the specific update path (e.g., /plugins/update/) rather than a generic landing page.
• Development Environment Testing: A developer running a 32