URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging 32-bit malicious URLs to execute payloads or establish command-and-control channels, often exploiting legacy architecture vulnerabilities or specific binary compatibility. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or network traffic patterns before the 32-bit payload fully executes or propagates, reducing the dwell time of high-severity threats.

IOC Summary

Threat: 32-bit Total URLs: 9 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["118.173.198.115", "175.165.87.95", "79.36.217.100", "175.165.85.4", "182.116.15.173", "220.184.45.196", "210.208.110.20"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["118.173.198.115", "175.165.87.95", "79.36.217.100", "175.165.85.4", "182.116.15.173", "220.184.45.196", "210.208.110.20"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy 32-bit Application Updates: A widely deployed legacy line-of-business application (e.g., a 32-bit version of Adobe Acrobat Reader or a specific ERP client) initiates an automatic update check or license validation request to a known vendor endpoint that has been misclassified or temporarily listed on URLhaus due to a shared IP/ASN with a malicious actor.

  • Filter/Exclusion: Exclude URLs containing the specific vendor’s domain (e.g., *.adobe.com or *.erp-vendor.com) and restrict the exclusion to processes running from the known installation directory (e.g., C:\Program Files (x86)\LegacyApp\).

• Scheduled Telemetry from 32-bit Monitoring Agents: A 32-bit agent for a monitoring or APM tool (e.g., Dynatrace, New Relic, or AppDynamics) running under a service account sends periodic heartbeat or telemetry data to a cloud ingestion endpoint. If this endpoint is hosted on a shared infrastructure or has a temporary URLhaus tag, the agent’s outbound connection triggers the alert.

  • Filter/Exclusion: Exclude URLs matching the specific telemetry ingestion domain (e.g., *.dynatrace.com or *.newrelic.com) and verify the initiating process is the known agent binary (e.g., dtagent.exe or nragent.exe) running as a Windows Service.

• Browser Cache/History Sync in 32-bit Browsers: Users with 32-bit versions of browsers (e.g., older builds of Chrome, Firefox, or Edge) that have a history of visiting a URL that was subsequently added to URLhaus. When the browser performs background sync, prefetching, or cache validation, it may re-establish a connection to the URL, triggering the detection rule even though the user did not actively visit the site recently.

  • *