URLhaus: arm Malicious URLs

Hunt Hypothesis

This detection targets adversary behavior where compromised hosts initiate network connections to known ARM-tagged malicious URLs identified by URLhaus, indicating potential command-and-control activity or initial infection vectors. The SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly identify and isolate affected assets before the threat escalates into a broader lateral movement campaign.

IOC Summary

Threat: arm Total URLs: 12 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: arm
let malicious_domains = dynamic(["129.121.114.124", "41.216.189.236", "129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.114.124", "41.216.189.236", "129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: arm Malicious URLs detection rule in an enterprise environment, along with targeted filtering strategies:

• Enterprise Antivirus Definition Updates via Cloud Sync

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads definition updates and threat intelligence feeds from the vendor’s cloud repository. These repositories often host thousands of URLs that are dynamically generated; occasionally, a specific URL used for a “arm” (ARM architecture) mobile agent update may be flagged by URLhaus as suspicious due to recent registration or high traffic volume before being fully whitelisted globally.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (falcon.sys, MsMpEng.exe) and filter for URLs containing the vendor’s specific domain suffix (e.g., *.crowdstrike.com or *.microsoft.com). Additionally, exclude traffic originating from the specific Service Account used by the AV management console.

• Scheduled Mobile Device Management (MDM) Policy Pushes

  • Scenario: During a scheduled maintenance window (e.g., every Tuesday at 02:00 UTC), the IT team pushes new configuration profiles and security policies to mobile devices via an MDM solution like Microsoft Intune or VMware Workspace ONE. The “arm” tag in the detection logic likely correlates with ARM-based mobile clients (iOS/Android) accessing these policy endpoints. If the MDM’s content delivery network (CDN) URL is newly provisioned, it may trigger a false positive for malicious activity despite being a legitimate administrative task.
  • Filter/Exclusion: Implement a filter based on the Source IP Range of the corporate MDM gateway and the specific User Agent strings associated with Intune or Workspace ONE agents (e.g., Intune-MA