URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the exploitation of ELF (Executable and Linkable Format) malware distributed via malicious URLs, which often indicates initial access or command-and-control activities targeting Linux-based endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised systems and prevent lateral movement, given that ELF-specific threats are frequently overlooked in environments primarily optimized for Windows-centric detection logic.

IOC Summary

Threat: elf Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["129.121.114.124"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.114.124"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Patching via Microsoft Update Catalog

  • Context: The Windows Update service or SCCM (System Center Configuration Manager) agents frequently download .elf executable binaries from the official go.microsoft.com or download.windowsupdate.com domains. These files often contain embedded URLs that URLhaus flags as “elf” type, triggering a hit despite being legitimate patch payloads.
  • Suggested Filter/Exclusion: Create an exclusion rule for source IPs belonging to your internal SCCM distribution points and exclude the specific Microsoft domains (*.go.microsoft.com, *.download.windowsupdate.com) from the URLhaus alert scope when the file extension is .elf or the process name matches wuauclt.exe.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise Endpoint Protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) run scheduled jobs every morning to fetch definition updates. These updates often include ELF-format signature databases or helper executables that reference internal or vendor-hosted URLs tagged as “elf” by the threat intelligence feed.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 04:00 local time) for alerts generated by known AV service processes (C:\Program Files\CrowdStrike\fs_qr.exe or MsMpEng.exe). Additionally, whitelist the vendor’s update servers (e.g., *.crowdstrike.com, *.microsoft.com) if they are consistently generating this specific tag.

• Scenario: DevOps CI/CD Pipeline Artifact Retrieval

  • Context: Build agents in Azure DevOps or Jenkins pipelines