URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where threat actors leverage newly identified ELF (Executable and Linkable Format) malicious URLs to deliver payloads that may bypass traditional static analysis by exploiting dynamic execution environments. Proactive hunting for these specific URL signatures in Azure Sentinel is critical because the high severity of ELF-based threats indicates a sophisticated attack vector capable of establishing persistent footholds through web traffic before broader detection mechanisms engage.

IOC Summary

Threat: elf Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["31.77.227.128"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.77.227.128"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: elf Malicious URLs detection rule in an enterprise environment:

• Antivirus Definition Updates via Microsoft Defender SmartScreen

  • Scenario: The endpoint protection suite (e.g., Microsoft Defender for Endpoint) automatically contacts go.microsoft.com or dl.delivery.mp.microsoft.com to download the latest definition updates. These URLs often host executable files with ELF headers (common in cross-platform tools or containerized agents) that URLhaus may flag as “elf” type, triggering a false alert despite being benign internal traffic.
  • Filter/Exclusion: Exclude traffic originating from the specific Microsoft Defender Antivirus Service process ID (PID) and whitelist the domains *.microsoft.com and dl.delivery.mp.microsoft.com in the detection rule logic.

• Scheduled CI/CD Artifact Deployment via Jenkins/GitLab Runners

  • Scenario: A scheduled nightly job on a build server (e.g., Jenkins or GitLab Runner) pulls Docker images or binary artifacts from an internal artifact repository (like Artifactory or Nexus). These repositories often serve ELF binaries for Linux-based containers. If the URLhaus feed detects these specific artifact download URLs as “elf” type, it may generate alerts during deployment windows even though they are trusted internal sources.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–04:00 AM) for the build server’s IP range and exclude URLs containing paths like /artifacts, /docker, or /nexus from the rule trigger conditions.

• Cloud Backup Agent Synchronization (Veeam/Commvault)

  • Scenario: Enterprise backup agents (such as Veeam Backup & Replication or Commvault) periodically poll cloud storage endpoints to retrieve metadata or small utility scripts stored as ELF