URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the distribution of ELF (Executable and Linkable Format) malware through newly identified malicious URLs tracked by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate potential Linux-based threats before they compromise cloud infrastructure or hybrid endpoints.

IOC Summary

Threat: elf Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["waf.proxytunnel.co"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["waf.proxytunnel.co"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the URLhaus: elf Malicious URLs detection rule in an enterprise environment:

• Scenario: Legitimate software updates from trusted vendors (e.g., Microsoft Update, Adobe Creative Cloud) downloading ELF executable patches.

  • Context: Automated background jobs often fetch .elf binaries or installers containing embedded ELF structures from official vendor domains.
  • Suggested Filter/Exclusion: Create an allowlist for known benign source domains (e.g., *.update.microsoft.com, *.adobe.com) and exclude traffic where the HTTP User-Agent contains specific strings like “Microsoft-Update” or “Adobe-CC”.

• Scenario: Internal DevOps pipelines executing containerized builds that download ELF binaries from internal artifact repositories.

  • Context: CI/CD tools (e.g., Jenkins, GitLab Runner) frequently pull Docker images or build artifacts containing ELF headers from internal Nexus or Artifactory servers during scheduled nightly builds.
  • Suggested Filter/Exclusion: Exclude traffic originating from specific IP ranges assigned to the DevOps subnet and filter out requests where the destination URL path contains keywords like /artifacts, /docker-images, or /builds.

• Scenario: Enterprise Endpoint Detection and Response (EDR) agents performing scheduled signature definition updates.

  • Context: Tools such as CrowdStrike Falcon, SentinelOne, or Carbon Black periodically download large ELF-based update packages from their global distribution networks to refresh local threat intelligence databases.
  • Suggested Filter/Exclusion: Implement a rule exclusion based on the hostname of the EDR management server (e.g., falcon.crowdstrike.com) and filter out URLs where the file extension is .cab or .zip containing ELF payloads, as these are standard update formats.

• Scenario: Scheduled administrative tasks involving remote script