← Back to SOC feed Coverage →

URLhaus: elf Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-18T23:00:01Z · Confidence: medium

Hunt Hypothesis

This rule detects potential compromise via the “elf” malware family, which often leverages malicious URLs to deliver payloads or establish command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify early-stage infections or lateral movement attempts before the adversary can fully establish persistence within the environment.

IOC Summary

Threat: elf Total URLs: 21 Active URLs: 14

URLStatusThreatDate Added
hxxp://176.65.139.206/main_x86_64offlinemalware_download2026-09-18
hxxp://176.65.139.206/main_ppcofflinemalware_download2026-09-18
hxxp://176.65.139.206/main_mipsofflinemalware_download2026-09-18
hxxp://176.65.139.206/main_arm7offlinemalware_download2026-09-18
hxxp://46.151.182.200/arm5onlinemalware_download2026-09-18
hxxp://46.151.182.200/i686onlinemalware_download2026-09-18
hxxp://46.151.182.200/arconlinemalware_download2026-09-18
hxxp://46.151.182.200/i586onlinemalware_download2026-09-18
hxxp://46.151.182.200/mipsonlinemalware_download2026-09-18
hxxp://46.151.182.200/sparconlinemalware_download2026-09-18
hxxp://46.151.182.200/mipselonlinemalware_download2026-09-18
hxxp://46.151.182.200/m68konlinemalware_download2026-09-18
hxxp://46.151.182.200/arm4onlinemalware_download2026-09-18
hxxp://46.151.182.200/ppconlinemalware_download2026-09-18
hxxp://46.151.182.200/arm6onlinemalware_download2026-09-18
hxxp://176.65.139.206/main_armonlinemalware_download2026-09-18
hxxp://176.65.139.206/main_x86offlinemalware_download2026-09-18
hxxp://176.65.139.206/main_m68kofflinemalware_download2026-09-18
hxxp://176.65.139.206/main_mpslonlinemalware_download2026-09-18
hxxp://176.65.139.206/main_sh4onlinemalware_download2026-09-18
hxxp://176.65.139.206/main_arm6offlinemalware_download2026-09-18

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["176.65.139.206", "46.151.182.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.206", "46.151.182.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/