URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior involving the exploitation of ELF (Executable and Linkable Format) binaries delivered through known malicious URLs to initiate command execution or payload delivery on Linux-based systems. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before these executable threats can establish persistence within the environment.

IOC Summary

Threat: elf Total URLs: 11 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["45.38.249.63"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.38.249.63"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Scenario 1: Automated Software Update Mechanisms

  • Context: Enterprise deployment tools like Microsoft System Center Configuration Manager (SCCM) or Intune frequently pull update manifests and installer packages from vendor repositories. These URLs often contain elf (Executable and Linkable Format) signatures within the payload metadata, which URLhaus may flag as suspicious if the specific hash is new to their database but legitimate for the organization.
  • Filter/Exclusion: Create an exclusion rule based on the source IP ranges of known update servers (e.g., *.microsoft.com, *.adobe.com) or whitelist specific high-fidelity domains used by the IT team’s patching infrastructure.

• Scenario 2: Scheduled Antivirus Definition Syncs

  • Context: On-premise security appliances such as CrowdStrike Falcon, Symantec Endpoint Protection, or Trend Micro run scheduled jobs (typically early morning) to download the latest threat intelligence feeds and definition updates. These downloads often involve ELF-formatted binaries from cloud endpoints that trigger the rule due to their binary structure, even though they are trusted sources.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00 – 04:00 local time) for specific security appliance hostnames, or exclude traffic originating from the internal security management server’s IP address.

• Scenario 3: Internal DevOps Artifact Retrieval

  • Context: Development teams using Jenkins, GitLab CI/CD, or Azure DevOps pipelines frequently pull container images and build artifacts stored in private registries (e.g., Harbor,