URLhaus: arm Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging ARM-tagged malicious URLs to execute initial infection vectors or command-and-control communications within the network. The SOC team should proactively hunt for these specific indicators in Azure Sentinel to identify early-stage compromises and block lateral movement before the malware establishes persistence on endpoints.

IOC Summary

Threat: arm Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["ths.lat"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["ths.lat"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Definition Updates

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, initiates a scheduled background job to download the latest malware definition signatures. These signature packages often contain embedded URLs pointing to vendor repositories that may be flagged by URLhaus due to high traffic volume or recent changes in their certificate chains, triggering the “arm” tag erroneously.
  • Suggested Filter: Exclude outbound HTTPS connections (Port 443) from known EDR service accounts (e.g., svc_crowdstrike, LocalSystem) specifically targeting vendor domains like *.crowdstrike.com or *.microsoft.com.

• Software Deployment and Patch Management

  • Scenario: During the monthly maintenance window, the IT team utilizes Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager to push a critical security patch. The deployment agent on user workstations attempts to verify the integrity of the package by querying multiple URLs within the vendor’s software distribution network. If these URLs are newly registered or heavily utilized, URLhaus may classify them as “arm” (Armed/Active Risk) despite being legitimate sources.
  • Suggested Filter: Create an exclusion rule for traffic originating from the SCCM service process (ccmexec.exe) communicating with internal distribution point IP ranges and specific vendor update domains (e.g., *.download.windowsupdate.com).

• Automated Backup Verification Jobs

  • Scenario: An enterprise backup solution like Veeam Backup & Replication runs a scheduled integrity check job every night at 2:00 AM. This