URLhaus: elf Malicious URLs

Hunt Hypothesis

This rule detects potential compromise through the execution of malicious ELF binaries, a technique often used by adversaries to deploy Linux-based payloads or establish footholds on cloud-native workloads. Proactively hunting for these specific URLhaus-tagged indicators in Azure Sentinel allows the SOC to identify early-stage infections or lateral movement attempts before they escalate into broader infrastructure breaches.

IOC Summary

Threat: elf Total URLs: 12 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["176.65.139.131", "45.198.224.168", "46.151.182.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.131", "45.198.224.168", "46.151.182.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Internal Staging or Canary Instances: Developers or DevOps teams may spin up short-lived staging environments, canary deployments, or internal test servers that are temporarily registered with URLhaus for tracking or monitoring purposes before full production rollout.

  • Filter/Exclusion: Exclude URLs where the hostname matches known internal staging subdomains (e.g., *.staging.internal.corp, *.canary.prod) or where the source IP is within the trusted internal CIDR range and the user agent identifies as an internal monitoring tool (e.g., NewRelicAgent, DatadogAgent).

• Automated Vulnerability Scanners and Penetration Tests: Enterprise security teams regularly run automated vulnerability scanners (e.g., Qualys, Tenable, Nessus) or conduct authorized penetration tests that probe known endpoints, including those listed in threat intelligence feeds like URLhaus, to verify exposure or validate remediation.

  • Filter/Exclusion: Exclude alerts where the source IP belongs to the security scanning subnet (e.g., 10.20.50.0/24) and the request timestamp aligns with scheduled scan windows (e.g., every Tuesday 02:00–04:00 UTC). Additionally, exclude if the HTTP status code is 404 or 403 and the user agent contains Nessus or Qualys.

• CDN or Reverse Proxy Caching of Legacy Assets: In large enterprises, legacy web applications or static asset hosts may be fronted by a CDN (e.g., Akamai, CloudFront) or reverse proxy (e.g., Nginx, HAProxy). If a legacy URL was previously flagged as malicious but is still served via cache or redirect for backward compatibility, it may trigger the rule despite being internally managed.

  • Filter/Exclusion: Exclude URLs where the