URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection targets adversaries leveraging ARM-tagged malicious URLs to deliver targeted payloads or redirect users to compromised endpoints within the Azure Sentinel environment. Proactive hunting is essential because these specific URL signatures often indicate early-stage reconnaissance or supply chain compromises that require immediate investigation before lateral movement occurs.

IOC Summary

Threat: arm Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["176.65.139.233", "game.dualuoilocphu.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.233", "game.dualuoilocphu.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to verify URL reachability. These tools often generate high-volume traffic against known “suspicious” domains that are actually part of the scanner’s baseline testing library, triggering the arm tag due to heuristic matching rather than actual compromise.
  • Filter/Exclusion: Exclude source IPs belonging to the security scanning subnet (e.g., 10.20.50.0/24) or filter out traffic where the User-Agent string contains specific scanner identifiers like Nessus, QualysGuard, or Rapid7.

• Scenario: Scheduled Cloud Backup and Sync Operations

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Microsoft Azure Backup) perform scheduled off-site replication jobs that connect to cloud storage endpoints. These URLs often host large binary payloads or API endpoints that URLhaus may flag as arm due to their dynamic nature and high entropy, even though they are legitimate backup destinations.
  • Filter/Exclusion: Create an exclusion list for specific destination FQDNs used by the backup vendor (e.g., *.azure.com, *.veeam.com) or filter based on scheduled time windows (e.g., exclude alerts occurring between 02:00 and 06:00 UTC) where these jobs are known to run.

• Scenario: Third-Party API Integration Calls

  • Context: Business applications (such as Salesforce, ServiceNow, or