URLhaus: elf Malicious URLs

Hunt Hypothesis

This hunt targets the execution of malicious ELF binaries delivered via known URLhaus URLs, indicating an adversary is likely establishing a foothold or deploying payloads on Linux-based assets. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised workloads or containers that may have been used for lateral movement or data exfiltration before the threat actor can escalate privileges.

IOC Summary

Threat: elf Total URLs: 11 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["217.60.103.135"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.60.103.135"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a browser extension (e.g., LastPass, 1Password, or a custom internal SSO helper) that automatically appends a specific tracking or session parameter to URLs. If the “elf” tag in URLhaus corresponds to a known benign query string pattern (e.g., ?elf=1 or similar) used by these tools for analytics or state management, legitimate clicks on internal dashboards or SaaS applications could trigger the alert.

  • Filter/Exclusion: Exclude URLs where the query string contains known benign parameters associated with enterprise browser extensions or internal analytics tools (e.g., *?session_id=*, *?tracking=internal*). Alternatively, whitelist specific user agents known to be generated by these extensions if the rule inspects headers.

• Scenario: An automated scheduled job (e.g., a Python or Bash script running via cron or Windows Task Scheduler) performs a health check or data sync by fetching a specific API endpoint or resource. If the script hardcodes a URL that matches one of the 11 “elf” URLs (perhaps due to a shared staging environment, a misconfigured CDN, or a legacy endpoint reused for a benign purpose), the request will appear as a direct hit.

  • Filter/Exclusion: Exclude traffic originating from known service accounts or specific hostnames associated with CI/CD pipelines and monitoring agents (e.g., jenkins-slave-*, prometheus-node-exporter, ansible-control-node). Ensure the exclusion is scoped to the specific source IP range or hostname to avoid over-filtering.

• Scenario: A security testing or vulnerability scanning tool (e.g., Nessus, Qualys, or an internal DAST scanner) is configured to probe a list of known malicious or legacy URLs to verify their status or check for redirects. If the scanner includes the “elf” URLs in