URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the execution or access of ARM architecture-specific malicious URLs known to distribute mobile and IoT-targeted threats. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints before these specialized payloads propagate across hybrid cloud environments where traditional x86-focused defenses may lack visibility.

IOC Summary

Threat: arm Total URLs: 12 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["129.121.110.105", "91.199.133.133"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.110.105", "91.199.133.133"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with targeted filtering strategies:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to check for known malicious indicators. These tools often query the URLhaus API directly or scan against a feed of “arm” tagged URLs, triggering the rule even though the traffic is benign and expected.
  • Filter/Exclusion: Create an exclusion based on the source IP address range of the security scanner appliances. Alternatively, filter out events where the User-Agent string contains specific identifiers like Tenable.Nessus, QualysGuard, or Rapid7-Scanner.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint Protection platforms (such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection) run scheduled jobs to download the latest threat intelligence feeds. These updates often reference URLhaus “arm” tags to synchronize local databases with global threat data, causing legitimate outbound connections that match the detection logic.
  • Filter/Exclusion: Exclude traffic originating from the specific service accounts or hostnames associated with the AV management server (e.g., AV-Update-Svc or DefenderCloudSync). Filter by process name if available, excluding processes like MpCmdRun.exe, FalconSensorService.exe, or SymantecEngine.exe.

• Scenario: Admin Manual Threat Research

  • Context: Security analysts and IT administrators frequently visit the URLhaus dashboard (urlhaus.com) or specific “arm” tagged URLs to investigate alerts, verify IOCs, or perform manual threat hunting. When an admin navig