URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving newly discovered ELF (Executable and Linkable Format) malware distributed through malicious URLs tracked by URLhaus. Proactive hunting is essential in Azure Sentinel to rapidly isolate compromised endpoints before these executable payloads can establish persistence or initiate lateral movement within the network.

IOC Summary

Threat: elf Total URLs: 10 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["2.26.81.46", "62.60.249.165"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["2.26.81.46", "62.60.249.165"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Software Update Scans by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query the URLhaus API or internal threat intelligence feeds to fetch the latest “elf” (Executable File Format) signatures. These queries often hit known malicious URLs that are currently being analyzed or re-categorized by the vendor’s cloud service before a final clean status is assigned.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from specific management server subnets (e.g., 10.50.20.0/24) or exclude requests where the User-Agent string contains keywords like CrowdStrike, Defender, or SentinelOne.

• Scenario: Scheduled “elf” Artifact Ingestion by SIEM Threat Intelligence Modules

  • Context: The organization’s SIEM (e.g., Splunk, Elastic Security) runs a scheduled hourly job to ingest threat intelligence feeds from URLhaus. During the ingestion process, the system actively fetches and parses URLs tagged as “elf” to update its local database. If the feed contains a recently flagged but benign URL that is still in the “malicious” queue on URLhaus, it triggers this alert.
  • Filter/Exclusion: Exclude alerts generated by the specific SIEM ingestion service account (e.g., svc-siem-intel) or filter out events where the source IP matches the dedicated threat intelligence gateway (e.g., 192.168.50.15).

• Scenario: DevOps CI/CD Pipeline Artifact Verification

  • Context: In a DevOps environment,