URLhaus: elf Malicious URLs

Hunt Hypothesis

This rule detects the presence of known malicious URLs associated with ELF (Executable and Linkable Format) binaries, indicating potential compromise of Linux-based assets or containerized workloads. Proactively hunting for these indicators in Azure Sentinel is critical because ELF payloads are frequently used in cloud-native environments to establish persistence or execute lateral movement, often bypassing traditional Windows-centric detection logic.

IOC Summary

Threat: elf Total URLs: 11 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["194.41.112.119"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["194.41.112.119"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to fetch a build artifact or dependency from a URL that was temporarily hosted on a CDN or S3 bucket which later got flagged by URLhaus due to a shared IP or path collision.
  • Filter/Exclusion: Exclude alerts where the source process is a known build tool (e.g., docker.exe, kubectl.exe, python.exe running a pip or npm install script) and the destination URL matches the specific elf tag but originates from a trusted internal registry domain (e.g., *.internal.registry.com).
• Scenario: An automated backup job (e.g., Veeam, Commvault, or AWS Backup) restores or transfers data to a temporary staging area, and the metadata or manifest file contains a URL reference to a known elf sample used for integrity verification or test data.
  • Filter/Exclusion: Exclude alerts where the source process is a backup agent service (e.g., veeambackup.exe, commvaultagent.exe) and the event type is a file write or network connection to a path under a standard backup directory (e.g., C:\Backup\, /var/backups/).
• Scenario: A security team runs a YARA or ClamAV scan against a corpus of test files or known malicious samples (including the elf binaries) to validate detection coverage, causing the scanner to access the URLhaus API or download the sample directly.
  • Filter/Exclusion: Exclude alerts where the source process is a scanning tool (e.g., clamscan.exe, yara.exe, virustotal.exe) and the user account belongs to a service account group (e.g., SEC-SCAN-SVC) or the destination URL is the specific URLhaus API endpoint (`