URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints access URLs flagged by URLhaus as ARM (Advanced Persistent Threat) indicators, suggesting potential command and control or payload delivery activities. Proactively hunting for these specific malicious connections in Azure Sentinel is critical to rapidly isolate compromised assets before the threat actors can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: arm Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["skript.club"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["skript.club"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Patch Management Scans via WSUS or SCCM

  • Context: During scheduled maintenance windows, internal patch management tools (e.g., Microsoft Endpoint Configuration Manager/SCCM or WSUS) scan external repositories to check for the latest security updates. These scans often trigger rapid requests to multiple vendor endpoints that may be flagged by URLhaus as “arm” (often due to shared IP ranges or recent reputation changes in public cloud infrastructure).
  • Suggested Filter: Create an exclusion based on the Source Host or Process Name. Specifically, exclude traffic originating from the ccmexec.exe process (SCCM) or wuauclt.exe (Windows Update) when connecting to known internal update servers or specific vendor domains (e.g., *.microsoft.com, *.update.microsoft.com).

• Scenario: Automated Threat Intelligence Feeds Ingestion

  • Context: Security operations teams often utilize automated scripts or SIEM connectors (such as Splunk Add-ons, Elastic Beats, or custom Python scripts using the requests library) to poll external threat intelligence feeds. These jobs frequently query multiple URLs in quick succession to ingest IOC lists, which can mimic the “3 malicious URLs” pattern if the feed provider’s infrastructure is temporarily flagged by URLhaus.
  • Suggested Filter: Exclude traffic from specific Scheduled Task IDs or Service Accounts. Identify the service account running the ingestion job (e.g., svc-threat-ingest) and filter out events where the Destination Port matches standard API ports (80/443) for known threat feed domains (e.g., *.urlhaus.io, *.abuse.ch).

• **Scenario: Cloud Backup