URLhaus: arm Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging ARM-tagged malicious URLs to execute initial compromise or lateral movement within the network. The SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage threats and validate endpoint protection efficacy before widespread infection occurs.

IOC Summary

Threat: arm Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["103.130.215.73"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.130.215.73"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Health Checks & Telemetry Uploads

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, Carbon Black, or SentinelOne, periodically perform health checks and upload telemetry data to their cloud management consoles. These legitimate outbound connections often hit internal load balancers or specific API endpoints that URLhaus may flag due to shared IP ranges with known “arm” malware campaigns or recent domain reputation shifts.
  • Suggested Filter: Exclude traffic originating from the specific service accounts used by EDR agents (e.g., svc-crowdstrike-agent, svc-sentinelone) and restrict exclusions to destination ports commonly used for telemetry (e.g., TCP 443, 80) targeting known vendor IP ranges or domains ending in .crowdstrike.com or .sentinelone.net.

• Scheduled Patch Management & Software Updates

  • Scenario: Automated patch management tools like Microsoft WSUS, Ivanti Endpoint Manager, or Chocolatey initiate scheduled jobs to download update manifests and binaries. These tools frequently query third-party software vendor repositories (e.g., Adobe, Oracle, Microsoft Update) where specific URLs might be temporarily tagged as “arm” due to a widespread campaign affecting the vendor’s CDN edge nodes before full remediation.
  • Suggested Filter: Create an exclusion for scheduled tasks running during maintenance windows (e.g., 02:00–04:00 UTC) that originate from the Patch Management Server hostnames and target specific update repository domains (e.g., *.update.microsoft.com, *.adobe.io).

• **IT Admin Scripting &