URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the exploitation of ELF (Executable and Linkable Format) malware distributed via newly identified malicious URLs from the URLhaus threat intelligence feed. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the ELF payloads execute within the network environment.

IOC Summary

Threat: elf Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["85.11.167.203"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["85.11.167.203"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: elf Malicious URLs rule in an enterprise environment:

• Scenario: Automated Software Update Scanners

  • Context: Enterprise endpoint management tools like Microsoft System Center Configuration Manager (SCCM) or Jamf Pro frequently query external repositories to check for patch definitions. These scanners often download small executable payloads (.elf format on Linux agents or .exe wrappers) from update servers that may be newly registered with URLhaus, triggering the “elf” tag erroneously.
  • Filter/Exclusion: Exclude traffic originating from known internal management server IPs (e.g., 10.x.x.x) accessing specific vendor domains such as *.microsoft.com, *.jamfsoftware.com, or *.sccmupdate.microsoft.com.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps platforms like Jenkins, GitLab Runner, or Azure DevOps Agents often pull container images and build artifacts from public registries (e.g., Docker Hub, GitHub Packages). When these agents download ELF binaries for testing or deployment, the URLs generated by the registry’s CDN can be flagged as “elf” malicious due to high-volume, transient traffic patterns.
  • Filter/Exclusion: Create a whitelist for URLs containing specific path parameters common in artifact registries (e.g., *.docker.io, *.github.com) and restrict the rule trigger to non-build-time hours or exclude specific service accounts used by CI/CD agents.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Security suites such as CrowdStrike Falcon, SentinelOne, or Kaspersky Endpoint Security run scheduled jobs (typically early morning) to fetch the latest threat intelligence feeds and definition files. These updates often involve downloading