URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving initial access or command and control activities through six specific malicious URLs flagged by URLhaus with an “arm” tag. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints before they establish persistent connections or exfiltrate sensitive data via known threat infrastructure.

IOC Summary

Threat: arm Total URLs: 6 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["91.92.42.232"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.42.232"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Software Updates

  • Scenario: The Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune agent initiates a background update job to download the latest definition files for the “arm” architecture (often used for ARM-based devices like Surface Pro X or Windows on ARM). These updates frequently pull from Microsoft’s content delivery network, which may host URLs flagged by URLhaus due to shared infrastructure with known malicious campaigns.
  • Filter/Exclusion: Create an exclusion rule that whitelists traffic originating from the Microsoft Endpoint Configuration Manager service (ccmexec.exe) or specific Intune update worker processes targeting domains ending in .windows.net, .update.microsoft.com, and .azureedge.net.

• Cloud Security Agent Telemetry

  • Scenario: The CrowdStrike Falcon or SentinelOne agent performs a scheduled “arm” architecture component check, sending telemetry data to the vendor’s cloud ingestion points. If the security vendor recently rotated their SSL certificates or updated their API endpoints for ARM-based cloud instances, URLhaus might flag these new IP-to-URL mappings as suspicious until they are fully indexed.
  • Filter/Exclusion: Exclude URLs containing specific path parameters related to telemetry (e.g., /api/v1/telemetry, /ingest) when the source process is FalconSensor.exe or SentinelOneAgent.exe. Additionally, whitelist the specific CIDR blocks associated with the vendor’s cloud ingestion regions.

• Legacy Application Maintenance Scripts

  • Scenario: A scheduled PowerShell script (Invoke-WebRequest) runs nightly to check license validity for a legacy enterprise application (e.g., Adobe Creative Cloud Enterprise