URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving access to known ARM-tagged malicious URLs, which often indicate command-and-control communications or initial infection vectors from compromised endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected assets and prevent lateral movement before the threat escalates within the network perimeter.

IOC Summary

Threat: arm Total URLs: 7 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["162.249.125.141", "94.154.43.164", "94.154.43.37"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["162.249.125.141", "94.154.43.164", "94.154.43.37"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Console Updates: The organization’s Endpoint Detection and Response (EDR) solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically queries https://api.crowdstrike.com or similar vendor update endpoints to fetch the latest threat intelligence feeds. These URLs often contain ARM architecture-specific signatures that URLhaus flags as “arm” due to their heavy use of mobile/ARM-based agent protocols, triggering a false hit during nightly update cycles.

  • Filter: Exclude traffic originating from the specific EDR management server IP range or whitelist the vendor’s known update domains (e.g., *.crowdstrike.com, *.microsoft.com) within the detection logic.

• Mobile Device Management (MDM) Sync Jobs: Scheduled daily synchronization tasks for mobile device management tools like Microsoft Intune or VMware Workspace ONE push configuration profiles to a fleet of ARM-based devices (such as Surface Pro X tablets or iPads). The sync process generates high-volume traffic to https://manage.intuneweb.azure.cn which includes ARM-specific payload headers, causing the rule to misclassify these legitimate admin tasks as malicious.

  • Filter: Create an exclusion for URLs containing specific MDM path patterns (e.g., /sync, /profile) when the source user agent indicates a known MDM client or when the destination is within the internal Azure AD tenant domain.

• Cloud-Based CI/CD Pipeline Artifacts: The DevOps team utilizes GitHub Actions or Azure Pipelines to build and deploy containerized applications on ARM-based cloud infrastructure (e.g., AWS Graviton instances). During deployment, the pipeline fetches dependencies from https://maven.google.com or https://registry.npmjs.org, which URLhaus tags as