URLhaus: elf Malicious URLs

Hunt Hypothesis

This rule detects potential compromise through the use of known malicious URLs associated with the ELF malware family, which adversaries often leverage for command-and-control or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage intrusions and lateral movement attempts before they escalate into significant data exfiltration or persistence.

IOC Summary

Threat: elf Total URLs: 7 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["171.113.233.133", "45.135.193.63", "176.65.139.159"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["171.113.233.133", "45.135.193.63", "176.65.139.159"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to fetch a specific build artifact or dependency from a temporary staging server that shares the same IP/domain as the URLhaus entry, often due to internal DNS rebinding or shared hosting configurations.
  • Filter/Exclusion: Exclude traffic where the source is a known CI/CD runner service account (e.g., svc-cicd-runner) and the destination port is 443/80, provided the User-Agent header contains Jenkins or GitHub-Actions.
• Scenario: A legacy application server running a scheduled cron job or Windows Task Scheduler entry downloads a configuration file or license key from an outdated internal repository that has been re-purposed or migrated, causing the URL to match the malicious signature due to path similarity.
  • Filter/Exclusion: Exclude requests originating from the specific legacy application service account (e.g., app-legacy-config) where the HTTP method is GET and the response status is 200, limited to the specific subnet where the legacy app resides.
• Scenario: A security team performs a manual vulnerability scan or penetration test using tools like Nmap or ZAP against internal assets, and the scanner probes a known endpoint that happens to match the URL pattern of the malicious URLhaus entry.
  • Filter/Exclusion: Exclude traffic where the source IP belongs to the designated security scanning VLAN (e.g., 10.20.50.0/24) and the User-Agent contains Nmap or ZAP, or where the request is initiated by the sec-scan service account.
• Scenario: An endpoint agent (e.g., CrowdStrike, Carbon Black) performs a scheduled heartbeat or policy update check against an internal distribution point that