URLhaus: 32-bit Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging known 32-bit malicious web resources to establish command and control or deliver initial payloads within the Azure environment. Proactively hunting these specific URL patterns is critical because their high severity indicates a significant risk of active exploitation that may bypass standard static defenses, requiring immediate investigation to prevent lateral movement.

IOC Summary

Threat: 32-bit Total URLs: 13 Active URLs: 13

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 32-bit
let malicious_domains = dynamic(["110.138.7.189", "115.53.223.236", "216.126.86.69", "182.127.114.41", "42.230.43.246", "123.4.202.133", "182.46.196.157", "218.91.141.176", "171.114.231.43", "39.71.17.161", "46.236.65.23"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["110.138.7.189", "115.53.223.236", "216.126.86.69", "182.127.114.41", "42.230.43.246", "123.4.202.133", "182.46.196.157", "218.91.141.176", "171.114.231.43", "39.71.17.161", "46.236.65.23"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: 32-bit Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Legacy Application Patching via Windows Update Standalone Installer

  • Scenario: The 32-bit WindowsUpdateStandalone agent (or similar legacy patch management tools like older versions of SCCM) frequently downloads update manifests and binary patches from Microsoft’s content delivery network. These URLs often contain dynamic query parameters or specific hash strings that URLhaus may flag as “suspicious” due to high volume or non-standard path structures, even though the traffic is legitimate administrative maintenance.
  • Filter/Exclusion: Exclude traffic where the user agent contains WindowsUpdateStandalone and the destination domain belongs to update.microsoft.com, download.windowsupdate.com, or go.microsoft.com.

• Automated 32-bit Backup Agent Connectivity Checks

  • Scenario: Enterprise backup solutions running as 32-bit services (e.g., legacy Veeam agents, older Commvault components, or Acronis True Image) perform hourly “heartbeat” pings to their management consoles. These agents often initiate connections to external license validation servers or cloud storage endpoints that URLhaus has recently tagged with a generic “malicious” reputation due to shared IP ranges used by multiple tenants.
  • Filter/Exclusion: Create an exclusion for source processes named VeeamAgent.exe, cvdagent.exe, or AcronisService.exe connecting to known vendor domains (e.g., veeam.com, commvault.com) where the connection duration is less than 5 seconds and no data payload exceeds 10KB.

• Scheduled Software License Validation for 32-bit Development Tools

  • Scenario: Developers and IT administrators utilize 32-bit versions of