URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious URLs flagged by URLhaus with an ELF (Executable and Linkable Format) tag, indicating potential delivery of executable malware payloads via web traffic. A proactive hunt is essential to rapidly isolate compromised endpoints and analyze downloaded artifacts before the adversary can establish persistence or initiate lateral movement within the Azure Sentinel environment.

IOC Summary

Threat: elf Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["182.112.30.222", "91.199.133.133"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.112.30.222", "91.199.133.133"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with targeted exclusion strategies:

• Antivirus Endpoint Definition Updates: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon frequently download signature definition updates from vendor repositories. These updates often utilize .elf (Executable and Linkable Format) binaries hosted on secure subdomains that URLhaus may flag due to high traffic volume or new hash signatures.

  • Filter/Exclusion: Create a whitelist for the specific update server domains (e.g., *.microsoft.com, *.crowdstrike.com) and exclude URLs containing paths like /update or /definitions.

• CI/CD Pipeline Artifact Retrieval: DevOps teams using Jenkins, GitLab CI, or Azure DevOps often pull compiled .elf binaries or container images from internal artifact repositories (e.g., Nexus, Artifactory) during scheduled build jobs. These legitimate build triggers can generate traffic patterns that mimic the “malicious URL” signature of an ELF file download.

  • Filter/Exclusion: Exclude network traffic originating from known CI/CD service accounts or IP ranges (e.g., 10.x.x.x for internal build servers) and filter URLs containing specific artifact paths like /artifacts/builds/.

• Scheduled Database Backup Jobs: Automated backup solutions such as Veeam, Rubrik, or native SQL Server agents often download configuration scripts or temporary ELF-based utility tools from the management console to initiate backup routines. These scheduled jobs run at fixed intervals and may trigger the rule if the management URL is newly registered in threat intelligence feeds.

  • Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 UTC) or exclude URLs containing keywords like /backup,