← Back to SOC feed Coverage →

URLhaus: elf Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-06-28T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary behavior where compromised endpoints initiate connections to known ELF (Executable and Linkable Format) malware distribution sites, indicating potential lateral movement or command-and-control activity via malicious web traffic. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate systems engaging with high-risk ELF repositories before the executable payloads are downloaded and executed on critical infrastructure.

IOC Summary

Threat: elf Total URLs: 27 Active URLs: 27

URLStatusThreatDate Added
hxxp://72.56.52.158/bins/proxy.mipselonlinemalware_download2026-06-28
hxxp://72.56.52.158/bins/proxy.mipsonlinemalware_download2026-06-28
hxxp://94.154.43.87/main_aarch64onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_arm6onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_arm7onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_armonlinemalware_download2026-06-28
hxxp://94.154.43.87/main_arm5onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_ppconlinemalware_download2026-06-28
hxxp://94.154.43.87/main_sh4onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_m68konlinemalware_download2026-06-28
hxxp://94.154.43.87/main_x86onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_mipsonlinemalware_download2026-06-28
hxxp://94.154.43.87/main_x86_64onlinemalware_download2026-06-28
hxxp://94.154.43.87/main_mpslonlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/x86onlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/armv6lonlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/armv7lonlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/armv5lonlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/aarch64onlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/armv4lonlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/m68konlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/x86_64onlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/sh4onlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/ppconlinemalware_download2026-06-28
hxxp://162.248.100.101/n2/mips64onlinemalware_download2026-06-28

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["162.248.100.101", "72.56.52.158", "94.154.43.87"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["162.248.100.101", "72.56.52.158", "94.154.43.87"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://urlhaus.abuse.ch/