URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where malicious URLs from the URLhaus database are accessed or executed within the environment, signaling potential phishing campaigns or drive-by downloads targeting Azure workloads. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistence through known malicious web resources.

IOC Summary

Threat: arm Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["112.198.193.62"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.198.193.62"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Security Tool Health Checks

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform scheduled “heartbeat” or telemetry uploads to their cloud management consoles. These tools often query the urlhaus API directly or scan against known threat feeds, triggering connections that mimic malicious URL patterns due to high entropy in dynamic subdomains.
  • Filter/Exclusion: Create an exclusion rule based on the Source Hostname (e.g., *.falcon.crowdstrike.com, *.microsoftonline.com) or exclude traffic originating from specific Service Accounts used by these EDR agents. Additionally, filter out URLs containing known telemetry paths like /api/v1/health or /telemetry.

• Scenario: Scheduled Backup and Cloud Sync Operations

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or cloud sync tools like OneDrive for Business and SharePoint Online generate dynamic URLs during scheduled jobs. These URLs often contain long, randomized session IDs or blob identifiers (e.g., .../blob?sessionid=abc123xyz) which can be flagged as “arm” (anomaly) by the detection logic due to their high randomness and length.
  • Filter/Exclusion: Implement a filter excluding URLs that match specific Query Parameter patterns common in backup tools (e.g., exclude if URL contains ?sessionid= or &blob=...). Alternatively, whitelist the Destination IP ranges of major cloud providers (Azure AD, AWS S3 endpoints) known to host these backup services.