URLhaus: elf Malicious URLs

Hunt Hypothesis

Adversaries may leverage malicious URLs tagged with the “elf” family to deliver payloads or establish initial access, often through phishing or compromised web assets. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify potential compromise vectors early, reducing the dwell time of threats that exploit known malicious infrastructure.

IOC Summary

Threat: elf Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["61.53.116.232", "220.158.234.65"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["61.53.116.232", "220.158.234.65"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Checks: A legacy line-of-business application (e.g., an older version of SAP or a custom Java-based ERP module) may still be configured to check for updates or license validation against a hardcoded endpoint that has since been compromised or repurposed by an attacker (as seen in URLhaus).
  • Filter/Exclusion: Allowlist the specific user-agent string associated with the legacy application (e.g., Mozilla/5.0 (compatible; LegacyERP/2.0)) or exclude the specific source IP range of the application server if the request originates from a known internal subnet.
• Scheduled Backup Verification Jobs: A scheduled PowerShell or Bash script used by the IT Operations team to verify backup integrity or connectivity to a specific cloud storage endpoint (e.g., AWS S3 or Azure Blob Storage) might use a URL that was recently added to URLhaus due to a shared infrastructure compromise or a misconfigured CDN edge node.
  • Filter/Exclusion: Exclude network connections where the destination port is 443 and the source process is a known backup agent (e.g., VeeamAgent.exe, CommCell.exe, or python.exe running a specific script path like C:\Scripts\backup_verify.py).
• CI/CD Pipeline Dependency Fetching: A continuous integration pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) may fetch a dependency or artifact from a private registry or a third-party API that has been temporarily flagged by URLhaus due to a transient vulnerability or a misreported entry.
  • Filter/Exclusion: Allowlist the specific container image or service account identity used by the CI/CD runner (e.g., jenkins-agent, gitlab-runner) and restrict the exclusion to the specific namespace or project ID where the pipeline is executed.
• Internal Monitoring Agent Heartbeats: