URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving ELF (Executable and Linkable Format) malware distribution through known malicious URLs curated by URLhaus. Proactive hunting in Azure Sentinel is critical to intercept potential command-and-control communications or initial infection vectors before they compromise endpoints with executable payloads.

IOC Summary

Threat: elf Total URLs: 13 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["91.92.42.213", "45.90.163.37"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.42.213", "45.90.163.37"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Software Update Scanners

  • Context: Enterprise endpoint management tools like Microsoft System Center Configuration Manager (SCCM) or Intune frequently scan vendor repositories to check for the latest patches. These scanners often query URLs containing executable files (.elf or .exe) hosted on trusted domains (e.g., update.microsoft.com, downloads.oracle.com). The URLhaus feed may flag these specific update endpoints as “elf” malicious due to shared infrastructure with known threats, even though the traffic is legitimate.
  • Filter/Exclusion: Create a whitelist exclusion for the source IP ranges of your internal SCCM/Intune management servers and add trusted vendor domains (e.g., *.microsoft.com, *.oracle.com) to the rule’s allow-list.

• Scenario: Scheduled Antivirus Definition Syncs

  • Context: During nightly maintenance windows, tools like CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection automatically pull definition updates and threat intelligence feeds from their cloud repositories. These downloads often involve fetching ELF-format signature files or executable payloads that match the “elf” tag in URLhaus. The detection logic may misinterpret these routine, high-volume syncs as suspicious external access to malicious URLs.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 04:00 UTC) for the specific service accounts running the AV agents, or exclude traffic originating from the dedicated internal update proxy server IP addresses used by these security suites.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps teams using platforms like **J