URLhaus: elf Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging ELF-based malware to distribute payloads through a specific set of six known malicious URLs identified by URLhaus. The SOC team should proactively hunt for these indicators within Azure Sentinel to detect early-stage command-and-control communications or initial infection vectors before they escalate into broader lateral movements across the cloud environment.

IOC Summary

Threat: elf Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["skript.club"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["skript.club"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Definition Updates via Background Service

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) automatically downloads signature definition packages from the vendor’s update servers. These updates often contain executable payloads tagged as elf (common in Linux-based management nodes or hybrid environments) and may trigger on URLs known to host security tools that occasionally share IP ranges with threat intelligence feeds.
  • Filter/Exclusion: Exclude traffic originating from the specific service account (e.g., svc-av-updater) accessing the vendor’s official update domains (e.g., *.crowdstrike.com, update.microsoft.com). Additionally, filter out URLs where the HTTP User-Agent header contains the specific AV product version string.

• CI/CD Pipeline Artifact Retrieval

  • Scenario: Scheduled Jenkins or GitLab CI runners pull Docker images and build artifacts from internal registries (e.g., Harbor, AWS ECR) that host elf binaries for container orchestration. If the registry’s public-facing URL is flagged by URLhaus due to a shared infrastructure component or a recent certificate change, legitimate build jobs will trigger alerts every time they fetch base images containing ELF executables.
  • Filter/Exclusion: Create an exclusion rule based on the source IP ranges of the CI/CD runner nodes and the destination domain names of the artifact registries (e.g., *.ecr.amazonaws.com, harbor.internal.corp). Ensure the filter applies specifically to the GET HTTP method used for artifact downloads.

• Patch Management Deployment Agents

  • Scenario: Enterprise patch management tools like Ivanti or SCCM push updates to workstations and servers. During