URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors leverage newly identified ARM-tagged malicious URLs from URLhaus to deliver payloads or establish command-and-control channels within the network. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malware executes its full attack sequence.

IOC Summary

Threat: arm Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["31.56.209.153"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.56.209.153"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Threat Intelligence Feed Synchronization

  • Context: The enterprise SIEM or EDR agent (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) periodically queries the URLhaus API to fetch the latest threat intelligence feeds. These requests often hit known “arm” tagged endpoints that are part of the update mechanism itself, triggering a match against the detection logic.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., SIEM-Update-Server-01) and Process Name (siem_agent.exe or falcon-sensor.exe). Additionally, filter out traffic where the HTTP User-Agent string contains specific identifiers like CrowdStrike-Falcon or Microsoft Defender.

• Scenario: Scheduled Software Patching via WSUS/SCCM

  • Context: During nightly maintenance windows, System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) agents download patch manifests and installer packages from Microsoft’s update servers. Some of these distribution points utilize URL structures tagged by URLhaus as “arm” due to their dynamic nature, causing the rule to flag legitimate patch downloads as malicious.
  • Filter/Exclusion: Implement a time-based exclusion for the specific Scheduled Job (e.g., WSUS_Sync_Job) running between 02:00 and 04:00 UTC. Alternatively, exclude URLs containing the domain segment go.microsoft.com or download.windowsupdate.com when initiated by the process wuauserv.exe.

• Scenario: Cloud Backup Agent Connectivity Checks

  • Context: Enterprise backup solutions like Veeam Backup