URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints interact with known ELF (Executable and Linkable Format) malware distribution channels via specific malicious URLs flagged by URLhaus. Proactive hunting in Azure Sentinel is critical to intercept early-stage supply chain compromises or drive-by downloads targeting Linux workloads before they execute persistent payloads within the cloud environment.

IOC Summary

Threat: elf Total URLs: 13 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["141.11.88.126", "45.90.163.37"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["141.11.88.126", "45.90.163.37"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently perform background telemetry checks. These agents often query the URLhaus API or similar threat intelligence feeds to validate their own signature databases, triggering connections that match the “elf” (Executable and Linkable Format) tag even though no actual malware is present on the host.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts used by EDR agents (e.g., svc-crowdstrike, LocalSystem) or filter out connections where the User-Agent header contains strings like CrowdStrike-Telemetry or SentinelOne-Updater.

• Scheduled Patch Management and Repository Synchronization

  • Scenario: Automated patch management tools (e.g., WSUS, SCCM/MECM, or Ansible) regularly synchronize with upstream repositories to download update manifests. These processes often fetch ELF binaries from trusted vendor mirrors that are flagged by URLhaus due to the sheer volume of traffic or shared IP reputation, generating alerts for legitimate administrative maintenance windows.
  • Filter/Exclusion: Create a whitelist exclusion based on destination domains known to be internal patch servers (e.g., *.microsoft.com, *.sccm.local) and restrict the alert severity during scheduled maintenance windows (e.g., 02:00–04:00 UTC) for hosts belonging to the “Patch-Management” asset group.

• CI/CD Pipeline Artifact Builds

  • Scenario: In DevOps environments, build servers (e.g., **J