URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving access to newly identified ARM-tagged malicious URLs from the URLhaus threat intelligence feed, which often signal early-stage command and control or phishing campaigns. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected endpoints before these high-severity threats can establish persistence or exfiltrate sensitive data within the organization’s network.

IOC Summary

Threat: arm Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["lol.exodustrala.dpdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["lol.exodustrala.dpdns.org"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, along with targeted filtering strategies:

• Scenario: Automated Vulnerability Scanning by Security Tools

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to assess security posture. These tools often generate thousands of HTTP requests to diverse URLs, including those recently flagged in the URLhaus database as “arm” (potentially malicious) but actually benign in this specific context due to the scanner’s broad discovery scope.
  • Filter/Exclusion: Exclude traffic originating from known scanner service accounts or IP ranges.
    • Action: Create a filter excluding source IPs belonging to Tenable-Nessus-Scanner and Qualys-Cache groups, or exclude user agents containing keywords like Nessus, Qualys-Policy-Manager, or Rapid7.

• Scenario: Scheduled EDR/AV Cloud Definition Updates

  • Context: Endpoint Detection and Response (EDR) solutions such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne perform scheduled cloud-based definition updates. During these cycles, the agents connect to update servers that may host URLs recently added to URLhaus with an “arm” tag before they are fully validated by the enterprise’s threat intelligence feed.
  • Filter/Exclusion: Exclude traffic from specific EDR update domains and scheduled time windows.
    • Action: Add a rule exclusion for destination domains ending in .falcon.crowdstrike.com, *.microsoft.com (specifically update paths), and *.sentinelone.net. Additionally, apply a time-based filter to exclude alerts occurring during the defined maintenance window (e.g., 02:00 –