URLhaus: elf Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the ELF (Elastic File Loader) framework to distribute malicious payloads or establish persistence through known bad URLs, often used in initial access or lateral movement phases. Proactively hunting for these specific URL patterns in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious network traffic before the ELF framework can fully execute its post-exploitation actions, reducing the dwell time of high-severity threats.

IOC Summary

Threat: elf Total URLs: 14 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["198.251.85.84"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["198.251.85.84"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Scripts: An older internal Java-based inventory management tool uses a hardcoded URL to check for updates or fetch configuration files. If the vendor’s CDN or hosting provider has been compromised or if the URL is shared with other benign services, the script will trigger the alert during its nightly scheduled update job.

  • Filter/Exclusion: Exclude the specific user account (e.g., svc-inventory-updater) or the process name (e.g., java.exe or powershell.exe if invoked by the script) when the destination URL matches the known benign internal IP range or specific domain associated with the legacy vendor.

• Third-Party SaaS Webhook Endpoints: A CI/CD pipeline (e.g., Jenkins or GitLab CI) sends build artifacts or status updates to a third-party monitoring or artifact storage service. If the SaaS provider’s API endpoint is listed in the URLhaus feed due to a transient compromise or shared infrastructure, the webhook call will trigger the detection.

  • Filter/Exclusion: Exclude the CI/CD service account (e.g., svc-jenkins-agent) or the specific process (e.g., curl.exe, wget.exe, or python.exe if using a custom script) when the destination URL belongs to the known SaaS provider’s domain (e.g., s3.amazonaws.com, github.com, or jfrog.io).

• Browser Caching or Pre-fetching: A user’s web browser (e.g., Chrome or Edge) pre-fetches or caches a URL that is part of a larger benign domain structure but happens to match the specific malicious path string. This can occur if the malicious URL is a subpath of a legitimate site that has been temporarily hijacked or if the URL is used in a legitimate A/B testing scenario.

  • Filter/Exclusion: Exclude the browser process (e