URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of ELF (Executable and Linkable Format) binaries delivered through known malicious URLs, indicating potential cross-platform threats targeting Linux or containerized workloads within the Azure environment. A SOC team should proactively hunt for these indicators to rapidly isolate compromised systems before adversaries leverage these entry points to establish persistence or exfiltrate sensitive data from cloud infrastructure.

IOC Summary

Threat: elf Total URLs: 6 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["45.196.97.80"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.196.97.80"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: elf Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated patching agents (e.g., Microsoft Endpoint Configuration Manager, Ivanti Neurons, or Jamf) periodically query the URLhaus API to fetch the latest list of malicious ELF binaries for local threat intelligence updates.

  • Filter/Exclusion: Exclude traffic originating from known management server IP ranges (e.g., 10.20.x.x for SCCM) where the destination is specifically urlhaus.abuse.ch and the HTTP method is GET.

• Scenario: Scheduled nightly jobs running on build servers (e.g., Jenkins, GitLab CI) execute a custom Python script that downloads sample ELF malware signatures from URLhaus to train internal machine learning models.

  • Filter/Exclusion: Create an exclusion for the specific user account or service principal associated with the CI/CD pipeline (e.g., svc-build-agent) when accessing the /api/v1/url endpoint during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Security analysts manually investigate potential threats using a SIEM dashboard or EDR console that integrates URLhaus data, triggering a direct browser request to download an ELF report for review.

  • Filter/Exclusion: Filter out alerts where the source user belongs to the “SOC-Analysts” Active Directory group and the HTTP User-Agent string contains keywords like Mozilla, Chrome, or Safari rather than automated service headers.

• Scenario: Third-party vulnerability scanners (e.g., Tenable Nessus, Qualys) perform routine external asset discovery, which includes probing public threat feeds to validate network perimeter security posture against known ELF threats.

  • **Filter