This detection identifies adversary behavior where threat actors leverage ELF (Executable and Linkable Format) files distributed via newly identified malicious URLs to deliver payloads across diverse operating systems. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate potential cross-platform infection vectors before they propagate through the enterprise network.
Threat: elf Total URLs: 30 Active URLs: 28
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://45.38.249.148/data_arm4 | online | malware_download | 2026-08-04 |
hxxp://45.38.249.148/data_powerpc | online | malware_download | 2026-08-04 |
hxxp://45.38.249.148/data_arm7 | online | malware_download | 2026-08-04 |
hxxp://45.38.249.148/data_arm6 | online | malware_download | 2026-08-04 |
hxxp://45.38.249.148/data_arm5 | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.arm6 | offline | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.mpsl | offline | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.arm7 | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.mips | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.arm5 | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.x86_64 | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.sh4 | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.x86 | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.arc | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.ppc | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.m68k | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.spc | online | malware_download | 2026-08-04 |
hxxp://94.154.43.231:3001/bins/boatnet.arm | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/x86_64 | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/armv7l | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/armv5l | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/m68k | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/sh4 | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/sparc | online | malware_download | 2026-08-04 |
hxxp://176.65.148.145/n2/armv6l | online | malware_download | 2026-08-04 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["45.38.249.148", "176.65.148.145", "94.154.43.231"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.38.249.148", "176.65.148.145", "94.154.43.231"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, including targeted filters and exclusions:
Scenario: Automated Software Update Scans by Endpoint Protection Agents
svc-crowdstrike, ms-defender-updater) and whitelist specific update domains such as *.crowdstrike.com or *.update.microsoft.com.Scenario: Scheduled Cloud Backup and Archiving Jobs
svc-veeam, azure-backup-agent) targeting known storage endpoints like *.blob.core.windows.net or *.s3.amazonaws.com.Scenario: Third-Party SaaS Integration Webhooks