URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where attackers leverage newly identified ELF (Executable and Linkable Format) malicious URLs to distribute executable payloads that may initiate command execution or lateral movement within the network. A SOC team should proactively hunt for these specific URL patterns in Azure Sentinel because early identification of ELF-tagged threats enables rapid containment before malicious executables compromise endpoints or exfiltrate sensitive data.

IOC Summary

Threat: elf Total URLs: 7 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["130.12.209.147", "103.161.17.92", "220.158.234.220"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["130.12.209.147", "103.161.17.92", "220.158.234.220"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: elf Malicious URLs” Rule

• Scenario: Automated Software Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM site server or distribution points frequently download installer packages and update manifests from vendor repositories that host ELF executable binaries. These downloads often originate from domains recently flagged by URLhaus as having hosted malicious ELF variants, even though the specific files being downloaded are legitimate.
  • Suggested Filter/Exclusion: Create an exclusion rule for traffic originating from SCCM management points (e.g., SCCM-ManagementPoint01) or distribution point FQDNs where the HTTP User-Agent string contains “Microsoft Endpoint Configuration Manager” and the destination URL path ends in .msi, .exe, or /packages/.

• Scenario: Scheduled Antivirus Definition Updates via CrowdStrike Falcon

  • Context: CrowdStrike’s scheduled update job (running every 6 hours) pulls definition files and sensor updates from a CDN that shares IP ranges with known malicious ELF hosts. The detection engine flags the initial handshake or specific binary download URLs as suspicious due to the “elf” tag, despite the traffic being part of a trusted internal maintenance window.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for the CrowdStrike update service during its defined maintenance windows (e.g., 02:00–04:00 UTC) on specific host groups tagged as “Falcon-Managed,” filtering out URLs containing updates.falcon.crowdstrike.com or content.falcon.crowdstrike.com.

• Scenario: CI/CD Pipeline Artifact Retrieval by Jenkins

  • Context: The enterprise Jenkins controller executes nightly build jobs that pull Docker images and binary artifacts from internal Nexus repositories or external registries (like Docker Hub). These pipelines often fetch ELF-based container layers