URLhaus: arm Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging ARM-tagged malicious URLs to deliver targeted payloads or phishing campaigns designed specifically for mobile and embedded environments within the organization’s network perimeter. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of ARM-specific threats can prevent lateral movement and data exfiltration before standard signature-based defenses identify the evolving campaign.

IOC Summary

Threat: arm Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["217.60.195.187"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.60.195.187"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Endpoint Definition Updates

  • Scenario: Enterprise endpoint protection agents (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently connect to the vendor’s update servers to download signature definitions. These updates often contain executable payloads tagged with “arm” architecture signatures, which URLhaus may flag as suspicious due to high-volume traffic patterns from known security vendors that overlap with threat intelligence feeds.
  • Filter/Exclusion: Create an exclusion rule for outbound HTTPS traffic destined for the specific CIDR ranges or FQDNs of your EDR vendor’s update servers (e.g., *.crowdstrike.com, *.sentinelone.net) where the user agent contains “UpdateService” or similar identifiers.

• Scheduled Software Patching via WSUS/SCCM

  • Scenario: During maintenance windows, automated patch management tools like Microsoft System Center Configuration Manager (SCCM) or WSUS pull large software packages from internal distribution points or external Microsoft content delivery networks. These downloads often include ARM64-compatible binaries for hybrid workstations (e.g., Surface Pro X) and may trigger the “arm” tag if the URLhaus feed associates these specific Microsoft update endpoints with recent threat activity.
  • Filter/Exclusion: Exclude traffic originating from the service account used by the patching engine (e.g., svc-sccm-patch) or filter URLs containing paths like /update.microsoft.com and /download.windowsupdate.com when the source IP belongs to the internal patch management subnet.

• Cloud Backup Agent Snapshots

  • Scenario: Cloud backup solutions such as Veeam Backup & Replication, **Comm