This hypothesis targets adversaries leveraging malicious ELF (Executable and Linkable Format) binaries hosted on known malicious URLs to execute Linux-based payloads, a common tactic for compromising cloud workloads and containerized environments. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised hosts or data exfiltration attempts before the ELF binaries can establish persistence or lateral movement within the Azure infrastructure.
Threat: elf Total URLs: 22 Active URLs: 17
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://143.20.185.213/armv5 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/mips | online | malware_download | 2026-09-26 |
hxxp://143.20.185.213/armv7 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/arm6 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/mpsl | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/arm | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/x86_64 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/i686 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/m68k | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/x86 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/ppc | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/sh4 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/musl | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/arm7 | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/spc | online | malware_download | 2026-09-26 |
hxxp://201.7.16.231/bins/arm5 | online | malware_download | 2026-09-26 |
hxxp://176.65.134.121:8080/cwhfhgmw.x86_64.sk | offline | malware_download | 2026-09-26 |
hxxp://176.65.134.121:8080/hkqvafuh.x86_64.sk | offline | malware_download | 2026-09-26 |
hxxp://176.65.134.121:8080/hkqvafuh.x86_64.se | offline | malware_download | 2026-09-26 |
hxxp://176.65.134.121:8080/cwhfhgmw.x86_64.se | offline | malware_download | 2026-09-26 |
hxxp://176.65.149.45/bins/sora.mpsl | offline | malware_download | 2026-09-26 |
hxxp://176.65.149.45/bins/sora.spc | online | malware_download | 2026-09-26 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["201.7.16.231", "176.65.149.45", "143.20.185.213"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["201.7.16.231", "176.65.149.45", "143.20.185.213"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
robots.txt or diagnostic endpoints to verify binary compatibility or cache status.
/health, /ping, or /diagnostics if the source IP is from the internal application server subnet.glibc or openssl shared objects) from specific CDN or internal artifact repositories that might be tagged with “elf” in the URL path for versioning clarity (e.g., .../lib/elf/v2.1/...).
Jenkins, GitLab-Runner, or Azure-DevOps and the URL path contains /artifacts/ or /packages/..../blobs/sha256/.../elf-layer-...).
/v2/ (Docker registry API prefix) and /blobs/.elf-backup-manifest.json) to a shared storage endpoint.
.json, .xml, or .manifest if the source IP is from the backup server