This detection identifies adversary behavior where compromised endpoints initiate connections to known ELF (Executable and Linkable Format) malware distribution sites, indicating potential lateral movement or command-and-control activity via malicious web traffic. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate systems engaging with high-risk ELF repositories before the executable payloads are downloaded and executed on critical infrastructure.
Threat: elf Total URLs: 27 Active URLs: 27
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://72.56.52.158/bins/proxy.mipsel | online | malware_download | 2026-06-28 |
hxxp://72.56.52.158/bins/proxy.mips | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_aarch64 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_arm6 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_arm7 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_arm | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_arm5 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_ppc | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_sh4 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_m68k | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_x86 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_mips | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_x86_64 | online | malware_download | 2026-06-28 |
hxxp://94.154.43.87/main_mpsl | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/x86 | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/armv6l | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/armv7l | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/armv5l | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/aarch64 | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/armv4l | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/m68k | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/x86_64 | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/sh4 | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/ppc | online | malware_download | 2026-06-28 |
hxxp://162.248.100.101/n2/mips64 | online | malware_download | 2026-06-28 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["162.248.100.101", "72.56.52.158", "94.154.43.87"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["162.248.100.101", "72.56.52.158", "94.154.43.87"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Protection Policy Updates via Microsoft Defender
*.microsoft.com and *.update.microsoft.com to download the latest definition signatures. These signature files often contain ELF (Executable and Linkable Format) binaries for Linux-based scanning engines or hybrid components, which URLhaus may flag as “elf” type malware if the specific hash is new or widely distributed but not yet fully whitelisted in their database.microsoft.com and the user agent string includes Microsoft Defender Antivirus or Windows Update Agent. Additionally, filter for HTTP status codes 200 (OK) on known update endpoints.Automated Container Image Scans by JFrog Artifactory
curl, openssl, or busybox) may trigger the “elf” malicious tag due to their generic nature and high frequency.10.x.y.z/24) accessing destination URLs ending in .jfrog.io or internal artifact repository domains, specifically when the file extension is .tar.gz, .docker, or .elf.**Patch Management