URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving newly reported ELF (Executable and Linkable Format) malware distributed via malicious URLs tracked by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints before executable payloads are downloaded and executed, thereby preventing potential lateral movement or data exfiltration.

IOC Summary

Threat: elf Total URLs: 5 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["eclipsebible.com", "31.77.227.111", "195.137.245.219"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["eclipsebible.com", "31.77.227.111", "195.137.245.219"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, along with targeted exclusion strategies:

• Scenario: Automated Software Update Scanners

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or WSUS frequently query external repositories to check for the latest updates. These scanners often download small executable payloads (.elf binaries) from trusted vendor domains which URLhaus may flag due to high volume or dynamic content generation, triggering the “elf” tag.
  • Filter/Exclusion: Create a whitelist exclusion for traffic originating from specific internal IP ranges assigned to patch servers and targeting known update domains (e.g., *.microsoft.com, *.sccm-updates.local). Alternatively, exclude URLs containing query parameters typical of version checks (e.g., ?action=scan or ?version=).

• Scenario: CI/CD Pipeline Artifact Downloads

  • Context: DevOps platforms such as Jenkins, GitLab CI, or Azure DevOps regularly pull build artifacts, container images, or dependency libraries from remote registries (e.g., Docker Hub, GitHub Packages). These pipelines often download .elf format binaries for testing environments. If the pipeline runs on a shared network segment, these legitimate downloads can be misidentified as malicious user-initiated traffic.
  • Filter/Exclusion: Exclude traffic initiated by service accounts or specific CI/CD worker groups (e.g., svc-jenkins-worker, azure-devops-agent). Additionally, filter out URLs containing standard artifact paths like /artifacts/builds/ or /releases/v1/.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection