URLhaus: elf Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging ELF-based malware to distribute malicious payloads through compromised or newly registered web endpoints identified by URLhaus. Proactively hunting for these specific ELF-tagged URLs in Azure Sentinel is critical because early detection of this delivery mechanism allows the SOC team to block initial infection vectors before they execute lateral movement within the network.

IOC Summary

Threat: elf Total URLs: 10 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["103.130.215.73"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.130.215.73"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Agent Updates (e.g., CrowdStrike Falcon or Microsoft Intune)

  • Scenario: The endpoint protection agent performs a scheduled background update of its signature database. During this process, the agent’s service account connects to the vendor’s cloud repository (often hosted on subdomains like update.falcon.crowdstrike.com or intune.microsoft.com) which may be newly registered or frequently changing IP addresses. URLhaus might flag these fresh URLs as “elf” (Executable/Legitimate File) with a high threat score due to the volume of traffic and new domain age, triggering the rule despite the connection being benign.
  • Suggested Filter: Create an exclusion for the specific User-Agent strings associated with the EDR agent (e.g., containing “CrowdStrike Falcon Sensor” or “Microsoft Intune Management Extension”) OR whitelist the known vendor update domains in the detection logic.

• Automated Software Deployment via Package Managers (e.g., Chocolatey or SCCM)

  • Scenario: A nightly scheduled job runs a PowerShell script using choco.exe to deploy new software versions to workstations. The script queries the Chocolatey community repository (community.chocolatey.org) and specific vendor CDNs to download .elf executable installers. If a newly published package URL is not yet fully indexed by URLhaus, it may be flagged as “malicious” due to low reputation scores or lack of historical data, even though the file hash matches the known good version in the internal artifact repository.
  • Suggested Filter: Exclude traffic originating from the specific service account used for deployment (e.g., DOMAIN\svc_choco_deploy) and limit the rule scope to exclude URLs containing standard