URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors leverage ARM-tagged malicious URLs from the URLhaus repository to deliver payloads or establish command-and-control channels within the Azure Sentinel environment. Proactive hunting for these specific indicators is critical due to their high severity classification, enabling the SOC team to rapidly isolate compromised endpoints and prevent lateral movement before broader infection occurs.

IOC Summary

Threat: arm Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Antivirus Definition Updates via Microsoft Defender

  • Scenario: The automated update service for Microsoft Defender Antivirus connects to go.microsoft.com or az891570.vo.msecnd.net to download the latest ARM (Architecture Risk Management) signature definitions. These endpoints are frequently flagged by URLhaus as “arm” related due to their association with security payloads, triggering false positives during scheduled nightly updates.
  • Filter/Exclusion: Create a rule exclusion for the specific process MsMpEng.exe when accessing Microsoft CDN domains (*.go.microsoft.com, *.vo.msecnd.net). Alternatively, whitelist these URLs in the detection logic if they are tagged with “clean” or “reputation_high” despite the “arm” tag.

• Azure Active Directory (Entra ID) Conditional Access Token Refresh

  • Scenario: Enterprise endpoints running Azure AD Connect or Intune agents perform periodic token refreshes by contacting login.microsoftonline.com. During these sessions, the system retrieves ARM-compliant security tokens which URLhaus may categorize under the “arm” tag. This is a standard administrative task for identity management that generates legitimate traffic often mistaken for malicious activity.
  • Filter/Exclusion: Exclude traffic originating from known service accounts (e.g., MSOL_HealthService) or filter out URLs containing login.microsoftonline.com and graph.microsoft.com when the HTTP status code is 200 OK, as these represent successful authentication handshakes rather than malicious redirects.

• Scheduled Backup Jobs via Veeam or Commvault

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication execute scheduled jobs that communicate with cloud repositories using ARM-based APIs for metadata synchronization. These connections often traverse through intermediate proxy URLs tagged by URLhaus as “arm” due to their interaction with cloud storage architectures, triggering the rule during peak backup windows (e