URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious URLs flagged by the ELF (Executable and Linkable Format) tag within the URLhaus threat intelligence feed, indicating potential delivery of executable malware or compromised web resources. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before the malicious payloads are executed on user systems.

IOC Summary

Threat: elf Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["103.83.86.215"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.83.86.215"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Antivirus Definition Updates via Cloud Repositories

  • Context: Enterprise Endpoint Protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently download definition updates from cloud repositories. These URLs often host ELF binaries (Linux executables) used by the update agents themselves or contain ELF signatures within their payload metadata, triggering the “elf” tag even though the content is benign and trusted.
  • Suggested Filter: Create an exclusion for known update server domains (e.g., *.update.microsoft.com, *.crowdstrike.com) where the source IP belongs to the internal update service account or specific jump hosts, rather than general user workstations.

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: DevOps teams using tools like GitLab CI, Jenkins, or GitHub Actions often pull container images or build artifacts (which are frequently ELF binaries) from internal artifact registries (e.g., Harbor, Nexus). When the pipeline agent accesses these URLs to deploy a new service, the URLhaus engine may flag the registry endpoint as malicious due to the presence of ELF structures in the response headers or payload.
  • Suggested Filter: Exclude traffic originating from specific CI/CD runner subnets (e.g., 10.20.40.0/24) destined for internal artifact repository URLs, ensuring that automated build jobs do not trigger alerts on standard deployment activities.

• Scenario: Scheduled Linux Backup Jobs Using Cloud Storage

  • Context: Scheduled backup agents (such as Veeam or Commvault) running on Linux servers often initiate connections to cloud storage buckets (e.g., AWS S3, Azure Blob) to upload binary logs or