This rule detects potential compromise via the “elf” malware family, which often leverages malicious URLs to deliver payloads or establish command-and-control channels. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify early-stage infections or lateral movement attempts before the adversary can fully establish persistence within the environment.
Threat: elf Total URLs: 21 Active URLs: 14
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://176.65.139.206/main_x86_64 | offline | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_ppc | offline | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_mips | offline | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_arm7 | offline | malware_download | 2026-09-18 |
hxxp://46.151.182.200/arm5 | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/i686 | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/arc | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/i586 | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/mips | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/sparc | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/mipsel | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/m68k | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/arm4 | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/ppc | online | malware_download | 2026-09-18 |
hxxp://46.151.182.200/arm6 | online | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_arm | online | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_x86 | offline | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_m68k | offline | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_mpsl | online | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_sh4 | online | malware_download | 2026-09-18 |
hxxp://176.65.139.206/main_arm6 | offline | malware_download | 2026-09-18 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["176.65.139.206", "46.151.182.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.206", "46.151.182.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Internal-Config-Fetcher/1.0) or restrict the rule to only alert on URLs accessed by interactive user sessions (excluding service principal logins).10.20.0.0/16) or exclude requests where the HTTP Method is OPTIONS or HEAD (common for connectivity checks) rather than GET or POST with a body.cron, systemd, nginx, apache2) and the destination port is 80 or 443, specifically filtering out URLs that end in /health, /ping, or /status.