URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the propagation of ARM-architecture-specific malware through known malicious URLs flagged by URLhaus. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before these targeted threats can establish persistence within the environment.

IOC Summary

Threat: arm Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, including tailored filters and exclusions:

• Automated Antivirus Definition Updates via Cloud Services

  • Scenario: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently pull definition updates from cloud repositories. These update manifests often contain ARM-architecture specific binaries or scripts hosted on URLs that may be newly registered and flagged by URLhaus as “arm” due to their recent creation date or lack of historical reputation data.
  • Filter/Exclusion: Create a whitelist exclusion for the known update server domains (e.g., *.update.microsoft.com, *.falcon.crowdstrike.com) within the detection rule logic, ensuring traffic originating from these specific FQDNs is bypassed regardless of the “arm” tag.

• Scheduled CI/CD Pipeline Artifact Retrieval

  • Scenario: DevOps teams utilize scheduled jobs (e.g., GitHub Actions, Azure DevOps) to download ARM64 container images or build artifacts from internal artifact registries (such as JFrog Artifactory or AWS ECR). When these pipelines run, they generate HTTP requests to URLs hosting ARM-specific packages which may be misclassified by URLhaus if the registry’s public IP ranges are not yet fully mature in threat intelligence feeds.
  • Filter/Exclusion: Implement a time-based exclusion window for known CI/CD execution hours (e.g., 02:00–06:00 UTC) combined with an allow-list of internal artifact registry IPs and the specific user-agent strings used by the pipeline agents (e.g., GitHub-Hookshot-*).

• Mobile Device Management (MDM) Profile Distribution

  • Scenario: IT administrators push configuration profiles or application packages to a fleet of ARM-based mobile devices (iOS on