URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors leverage newly identified ARM-tagged malicious URLs from the URLhaus repository to deliver payloads or facilitate command and control communications. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malicious URLs are widely adopted by automated defense systems.

IOC Summary

Threat: arm Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["46.151.182.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["46.151.182.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Antivirus Definition Updates via Scheduled Tasks

  • Scenario: Enterprise endpoints running scheduled jobs (e.g., Windows Task Scheduler) to fetch definition updates from major vendors like CrowdStrike, SentinelOne, or Microsoft Defender. The arm tag often flags these update servers because they host dynamic content that mimics malware distribution patterns.
  • Filter/Exclusion: Exclude URLs containing vendor-specific domains (e.g., *.crowdstrike.com, *.sentinelone.net, *.update.microsoft.com) where the HTTP User-Agent string matches known AV updater signatures and the connection originates from a dedicated “Update” service account.

• Cloud Storage Synchronization Services

  • Scenario: Users synchronizing large files via OneDrive for Business, SharePoint Online, or Box Enterprise. These services frequently generate dynamic, short-lived URLs with complex query parameters that URLhaus may misidentify as “arm” (Android Runtime/Mobile) malicious patterns due to the high volume of file transfer traffic.
  • Filter/Exclusion: Create an exclusion for all URLs under *.sharepoint.com, *.onedrive.live.com, and *.box.com where the HTTP method is GET or POST and the destination port is standard (443), specifically filtering out requests initiated by the OneDrive Sync client process (FileSync.exe).

• Software Deployment via Configuration Management Tools

  • Scenario: Automated deployment agents like Microsoft Endpoint Manager (Intune), SCCM, or Ansible Tower downloading application packages, scripts, or configuration manifests from internal artifact repositories. These tools often use ARM-based container registries or mobile-optimized endpoints