URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving access to ARM-tagged malicious URLs from the URLhaus threat intelligence feed, which often signal early-stage malware distribution or command-and-control communications. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before broader infection occurs.

IOC Summary

Threat: arm Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["31.77.227.110"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.77.227.110"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe internal and external assets. These tools often generate high volumes of HTTP/HTTPS requests to validate certificate chains, check for outdated software versions, or test firewall rules. The scanner’s engine may interpret specific API endpoints or health-check URLs as “arm” (ARM architecture) related traffic that matches the rule’s signature pattern, triggering false alerts.
  • Suggested Filter: Create an exclusion based on the Source IP Range of the security scanning appliances and the User-Agent string.
    • Filter Logic: Exclude if Source IP in [10.20.5.0/24] AND User-Agent contains "Tenable" OR "Qualys".

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Background services like Microsoft OneDrive for Business, Google Workspace Drive, or Veeam Backup & Replication run scheduled sync tasks during off-hours. These jobs often connect to cloud storage endpoints that utilize ARM-based infrastructure (common in modern hyperscalers like AWS Graviton instances). The detection logic may misinterpret these routine synchronization URLs as malicious “arm” traffic due to specific URL parameters or payload structures.
  • Suggested Filter: Implement a time-window exclusion combined with destination domain whitelisting.
    • Filter Logic: Exclude if Destination Domain in [one.microsoft.com, drive.google.com, veeam.net] AND Event Time is between 02:00 and 06:00 (Local Time).