URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints interact with newly identified ARM-tagged malicious URLs from the URLhaus threat intelligence feed to facilitate command and control or initial payload delivery. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised assets before they can establish persistence or exfiltrate sensitive data via high-severity web traffic channels.

IOC Summary

Threat: arm Total URLs: 7 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["31.56.209.153"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.56.209.153"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: arm Malicious URLs” Rule

• Scenario: Automated Software Update Scans

  • Context: Enterprise endpoint management tools like Microsoft Intune, Jamf Pro, or Ivanti Neurons periodically contact the arm (Android Runtime) update servers to check for patches or download configuration manifests. These requests often hit URLs that URLhaus has flagged as “arm” due to their high-volume traffic patterns, even though they are legitimate vendor endpoints.
  • Suggested Filter/Exclusion: Create a whitelist exclusion based on the specific source IP ranges of the update servers (e.g., *.microsoft.com, *.jamfsoftware.com) or exclude URLs containing known update path parameters like /api/update/arm from triggering this rule.

• Scenario: Scheduled Mobile Device Management (MDM) Syncs

  • Context: During nightly maintenance windows, MDM solutions such as VMware Workspace ONE or SailPoint IdentityIQ execute scheduled jobs to sync device policies and inventory data for Android-based corporate devices. These jobs generate traffic to ARM architecture-specific endpoints which may be misidentified by the detection logic as malicious due to the “arm” tag in URLhaus.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–04:00 UTC) for traffic originating from the MDM service accounts, or filter out URLs that contain specific query strings used by these vendors (e.g., ?sync=arm_policy).

• Scenario: Internal CI/CD Pipeline Artifacts

  • Context: DevOps teams using Jenkins, GitLab CI, or Azure DevOps often build and deploy ARM64 architecture containers. The pipelines frequently pull dependencies from internal artifact repositories (like **Nexus