URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of ELF binaries delivered via known malicious URLs, indicating potential supply chain compromises or drive-by downloads targeting Linux workloads. Proactive hunting for these indicators in Azure Sentinel is critical to rapidly isolate affected assets and prevent lateral movement before the malware establishes persistence within the environment.

IOC Summary

Threat: elf Total URLs: 10 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["ths.lat", "31.77.227.10"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["ths.lat", "31.77.227.10"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Patch Management Scans

  • Scenario: Endpoint protection agents (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) perform background scans to check the integrity of installed executables. These agents frequently query URLhaus APIs directly to validate the reputation of local ELF binaries against known threat intelligence feeds, triggering hits on legitimate internal scan traffic.
  • Suggested Filter: Exclude network flows originating from the specific service accounts or IP ranges used by the EDR management servers (e.g., Source_IP IN [EDR_Manager_Range] AND Process_Name = "falcon-sensor.exe").

• CI/CD Pipeline Artifact Validation

  • Scenario: DevOps pipelines using tools like Jenkins, GitLab CI, or Azure DevOps execute scheduled jobs to validate Linux build artifacts. During the deployment phase, these runners download and scan ELF binaries (such as Docker images or compiled Go binaries) against external threat intelligence services, generating legitimate requests that match the “elf” tag criteria.
  • Suggested Filter: Create an exclusion for traffic generated by CI/CD runner hostnames (e.g., Source_Host LIKE '%jenkins-runner%' OR Destination_Domain = 'urlhaus.abuse.ch') during standard business hours or scheduled maintenance windows.

• Third-Party SaaS Security Scans

  • Scenario: Enterprise security suites like Tenable Nessus, Qualys, or Rapid7 InsightVM run scheduled vulnerability assessments on Linux servers. These scanners actively download and analyze ELF files from the target systems to cross-reference them with URLhaus data, often flagging benign internal binaries that