This hypothesis posits that adversaries are actively leveraging a specific cluster of ARM-tagged malicious URLs to deliver payloads or conduct phishing campaigns within the organization’s network. Proactive hunting for these indicators in Azure Sentinel is critical because early identification allows the SOC team to block access before widespread compromise occurs, capitalizing on the high severity and known threat intelligence provided by URLhaus.
Threat: arm Total URLs: 31 Active URLs: 14
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://129.121.114.124/Bnxv | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/kLOX | offline | malware_download | 2026-07-21 |
hxxp://129.121.110.105/Cvk | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/tvCr | online | malware_download | 2026-07-21 |
hxxp://129.121.114.124/xWr | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/tTd | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/dNPT | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/C9M | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/AkFS | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/vuSO | offline | malware_download | 2026-07-21 |
hxxp://129.121.110.105/LHMi | offline | malware_download | 2026-07-21 |
hxxp://129.121.110.105/23N | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/Chfd | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/2Fr7 | offline | malware_download | 2026-07-21 |
hxxp://129.121.110.105/EmVP | offline | malware_download | 2026-07-21 |
hxxp://129.121.110.105/xu8 | offline | malware_download | 2026-07-21 |
hxxp://129.121.110.105/fIp | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/Avx5 | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/3wI | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/Z31w | online | malware_download | 2026-07-21 |
hxxp://129.121.114.124/03W7 | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/soH | offline | malware_download | 2026-07-21 |
hxxp://129.121.114.124/Qlz | online | malware_download | 2026-07-21 |
hxxp://129.121.114.124/cHz | online | malware_download | 2026-07-21 |
hxxp://129.121.110.105/MYP | offline | malware_download | 2026-07-21 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["129.121.114.124", "129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.114.124", "129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with targeted filtering strategies:
Endpoint Management Agent Updates
CrdSvc.exe, MsMpEng.exe) and whitelist the known vendor update domains (e.g., *.crowdstrike.com, update.microsoft.com, api.sentinelone.net).Scheduled Patch Management Deployments
arm tag.10.x.x.0/24) during defined maintenance windows (e.g., 02:00–06:00 local time), or filter by the service account identity used for these scheduled jobs (e.g., svc-patch-deploy).**Cloud Infrastructure Provisioning