This hypothesis targets adversaries leveraging the ELF malware family to deliver payloads or establish command-and-control channels via known malicious URLs. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic patterns before the malware executes, thereby reducing the dwell time of high-severity threats within the environment.
Threat: elf Total URLs: 25 Active URLs: 22
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://36.27.76.223:37201/Mozi.m | offline | malware_download | 2026-09-15 |
hxxp://86.38.182.156/i.sh | offline | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.x86 | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.mips | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/mpsl | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/spc | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.sh4 | offline | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.arm7 | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.mpsl | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.arm | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.spc | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/i686 | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.ppc | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/m68k | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/mips | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/x86 | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/arm | online | malware_download | 2026-09-15 |
hxxp://46.151.182.200/bins/dlr.arm5 | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/sh4 | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/arm5 | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/x86_64 | online | malware_download | 2026-09-15 |
hxxp://94.154.43.217/bins/ppc | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.arm6 | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.m68k | online | malware_download | 2026-09-15 |
hxxp://176.65.139.217/bins/sora.arm5 | online | malware_download | 2026-09-15 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["176.65.139.217", "46.151.182.200", "94.154.43.217"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.217", "46.151.182.200", "94.154.43.217"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legacy Application Update Scripts: A legacy internal web portal (e.g., built on older ASP.NET or PHP) uses a hardcoded URL pointing to a vendor’s update server that has since been compromised or repurposed by the elf campaign. The script runs via a scheduled task (Task Scheduler on Windows Server or cron on Linux) to check for updates, triggering the URL request.
svc-legacy-app) from the URL detection rule if the domain is known to be shared infrastructure.CI/CD Pipeline Dependency Fetching: A DevOps pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) downloads a specific open-source library or binary artifact from a public repository or CDN that has been temporarily hijacked or is a known false positive source for the elf tag. The build agent fetches the resource during a standard build job.
jenkins-agent, ci-runner) or the specific container image/namespace where the build occurs, provided the artifact checksum is verified by the pipeline’s integrity checks.Browser Cache/History Synchronization: An employee’s corporate browser (e.g., Edge or Chrome) synchronizes browsing history or bookmarks to a cloud service. If the employee previously visited a legitimate site that was later tagged as elf in URLhaus (due to a compromised subdomain or temporary injection), the sync process may re-request the URL or trigger a background check, appearing as a new malicious URL access.
msedge.exe, chrome.exe) if the detection is based on