URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving newly identified ELF (Executable and Linkable Format) malware distribution through malicious URLs flagged by URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical to intercept potential command-and-control communications or initial infection vectors before they compromise internal workloads.

IOC Summary

Threat: elf Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["94.154.43.42", "129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.42", "129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with targeted filtering strategies:

• Scenario: Automated Antivirus Definition Updates

  • Context: Enterprise endpoints running tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently initiate background downloads to fetch the latest signature databases. These updates often originate from official vendor domains (e.g., update.microsoft.com, falcon.crowdstrike.com) that host ELF executable payloads containing embedded URLs tagged as “elf” by URLhaus, which can be misidentified as malicious if the specific hash or domain isn’t in the allow-list yet.
  • Suggested Filter: Create an exclusion rule based on the Source Domain and Process Name. Exclude traffic where Destination_Domain matches known vendor update domains (e.g., *.microsoft.com, *.crowdstrike.com) AND Process_Name contains keywords like “UpdateService”, “DefenderSvc”, or “FalconSensor”.

• Scenario: Scheduled Software Deployment via Configuration Management

  • Context: IT administrators utilize tools such as Microsoft SCCM (Configuration Manager), Ansible, or Jenkins to push software patches and new applications. During these scheduled jobs, the deployment agents download ELF binaries from internal artifact repositories (e.g., Nexus Repository Manager, Artifactory) or external CDNs like S3 buckets. These URLs often carry the “elf” tag due to the nature of the payload but represent legitimate enterprise distribution channels rather than malicious activity.
  • Suggested Filter: Implement an exclusion based on User Identity and Destination IP Range. Exclude alerts where Initiating_User belongs to the “IT_Operations” or “Deployment_Svc” groups, OR where the destination IP falls within the enterprise