URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the distribution of ELF (Executable and Linkable Format) malware through newly identified malicious URLs, signaling potential command-and-control or initial access activities targeting Linux-based systems. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the ELF payloads execute within their cloud infrastructure.

IOC Summary

Threat: elf Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["31.58.171.194"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.58.171.194"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Antivirus Definition Updates via Cloud Repositories

  • Context: Enterprise endpoints running tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently pull definition updates from cloud repositories. These update servers often host ELF (Executable and Linkable Format) binaries that are dynamically generated or signed, which URLhaus may flag as “elf” type due to the file extension or MIME type in the HTTP response headers.
  • Filter/Exclusion: Create a whitelist exclusion for known update server FQDNs (e.g., *.crowdstrike.com, *.microsoft.com, update.symantec.com) specifically when the traffic originates from the “System” user account or specific service ports (e.g., 443, 80).

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: During nightly maintenance windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune push application installers (.msi or .exe) to workstations. These packages often contain embedded ELF binaries or trigger downloads of ELF-based components from internal distribution points that URLhaus categorizes as “elf” malicious signatures due to their binary structure.
  • Filter/Exclusion: Exclude traffic originating from the specific IP ranges of your Software Distribution Points (DP) and Application Gateways during defined maintenance windows (e.g., 02:00 – 06:00 UTC). Additionally, filter out URLs containing path segments like /ccmsetup or /intune/managedcontent.

• Scenario: Internal CI/CD Pipeline Artifacts

  • Context: DevOps