URLhaus: elf Malicious URLs

Hunt Hypothesis

This rule detects adversary behavior involving the execution of ELF (Executable and Linkable Format) binaries delivered via malicious URLs, which often indicates a cross-platform attack vector targeting Linux or containerized workloads within the Azure environment. A SOC team should proactively hunt for these specific threats to identify early-stage lateral movement or supply chain compromises that may bypass traditional Windows-centric detection logic in their Azure Sentinel workspace.

IOC Summary

Threat: elf Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["103.77.246.150", "85.11.167.203"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.77.246.150", "85.11.167.203"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Software Update Scans by Endpoint Protection Agents

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently poll the URLhaus API to fetch the latest threat intelligence feeds. These agents often download ELF-based signature files or scan reports that generate HTTP requests matching the “elf” tag, even though the traffic is benign and internal.
  • Suggested Filter: Exclude traffic originating from known EDR management server IPs (e.g., 10.x.x.x range for CrowdStrike) where the User-Agent string contains specific agent identifiers like Falcon-Service or Defender-Svc.

• Scenario: Scheduled Backup Jobs Accessing Cloud Storage Repositories

  • Context: Automated backup solutions (e.g., Veeam, Commvault) running nightly scheduled jobs often connect to cloud storage endpoints (AWS S3, Azure Blob) that host ELF executable binaries for version control or artifact management. The rule may flag these legitimate retrieval requests as potential malicious ELF downloads.
  • Suggested Filter: Create an exclusion based on the destination URL pattern containing specific backup domain suffixes (e.g., *.veeam.com, *.azureedge.net) and restrict the alert to only trigger during non-business hours if the job is known to run at 02:00 UTC.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps platforms (e.g., Jenkins, GitLab CI) frequently pull ELF binaries from internal artifact repositories (like Nexus or Artifactory) during build and deployment phases to verify container images or application executables. These legitimate downloads often match the “elf” signature logic of