URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving ELF (Executable and Linkable Format) malware distribution through known malicious URLs tracked by URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical to intercept potential command-and-control communications or initial infection vectors before they compromise internal workloads.

IOC Summary

Threat: elf Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["176.65.139.233", "103.226.250.88", "game.dualuoilocphu.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.233", "103.226.250.88", "game.dualuoilocphu.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: elf Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Patching Agents Scanning Vendor Repositories

  • Context: Endpoint protection tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Ivanti Neurons frequently initiate background scans against software vendor repositories (e.g., Adobe, Microsoft Update, Oracle) to check for the latest patches. These agents often query URLs that URLhaus has flagged as elf type due to historical activity or shared infrastructure with known malware distribution points.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from specific Service Accounts (e.g., svc-patching-agent) and targeting the top 10 vendor domains identified in your patching workflow (e.g., download.microsoft.com, adobe.io).

• Scenario: Scheduled Backup Jobs Accessing Cloud Storage Gateways

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Commvault run scheduled jobs to validate metadata and integrity of stored archives. These jobs often connect to cloud storage gateways (e.g., AWS S3, Azure Blob) via specific API endpoints that URLhaus may classify under the elf tag due to their executable nature or dynamic content delivery mechanisms.
  • Filter/Exclusion: Exclude URLs matching the regex pattern of your primary backup gateway domains and restrict the rule trigger to exclude traffic during known maintenance windows (e.g., 02:00–04:00 UTC) when these jobs are active.

• Scenario: Development Environments Deploying Container Images

  • Context: In DevOps pipelines using tools like Jenkins, GitLab CI/CD, or Azure DevOps, build agents pull container images and dependencies from