URLhaus: arc Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving access to newly identified malicious URLs tagged by URLhaus with the ‘arc’ classification, which often indicates emerging threats or specific campaign behaviors. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before broader exploitation occurs.

IOC Summary

Threat: arc Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arc
let malicious_domains = dynamic(["31.56.209.153"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.56.209.153"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arc Malicious URLs detection rule in an enterprise environment, along with targeted filters and exclusions:

• Scenario: Automated vulnerability scanning by internal security tools (e.g., Qualys or Tenable) probing external web resources.

  • Context: The scanner generates thousands of HTTP requests to various public endpoints, including those recently flagged by URLhaus as “arc” due to initial suspicious activity that is actually benign in the context of a scan.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host or Process Name. Exclude traffic originating from known scanner service accounts (e.g., QUALYS-SCANNER-SVC) and process names like qualyspc.exe or tenable-agent.exe.

• Scenario: Scheduled software update jobs for enterprise applications (e.g., Microsoft Office 365, Adobe Creative Cloud) fetching release notes.

  • Context: Background services periodically query vendor update servers to check for patches. These URLs may be newly registered and temporarily tagged as “arc” by URLhaus before being fully whitelisted globally.
  • Filter/Exclusion: Implement a time-based exclusion or filter the Destination Domain against a known list of trusted vendor domains (e.g., *.office.com, *.adobe.com). Additionally, exclude process paths containing \AppData\Local\Microsoft\Office\Updates.exe.

• Scenario: Legitimate administrative tasks involving cloud storage synchronization (e.g., OneDrive for Business or SharePoint).

  • Context: When an administrator manually triggers a large file sync or runs a “SharePoint Health Check,” the client may hit specific API endpoints that URLhaus has flagged as “arc” due to high-volume traffic patterns resembling bot behavior.
  • Filter/Exclusion: Exclude traffic where