URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints access known ELF (Executable and Linkable Format) malware distribution sites to initiate downloads or execute malicious binaries. The SOC team should proactively hunt for these indicators in Azure Sentinel to intercept early-stage infection vectors before they propagate across the environment, leveraging URLhaus intelligence to validate and block high-severity threats targeting Linux-based assets.

IOC Summary

Threat: elf Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["94.154.43.42"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["94.154.43.42"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule, tailored for an enterprise environment where legitimate ELF-related traffic is common:

• Automated CI/CD Pipeline Artifact Fetching

  • Scenario: Build agents (e.g., Jenkins, GitLab Runners) executing scheduled pipelines frequently download pre-compiled ELF binaries or shared libraries from internal artifact repositories (like Nexus or Artifactory) that host thousands of legitimate ELF files. If the repository’s domain is newly registered or has a high volume of dynamic content, URLhaus may flag these specific download URLs as suspicious “elf” threats due to heuristic matching against known malware patterns in similar domains.
  • Filter/Exclusion: Create an exclusion for the internal artifact repository CIDR ranges (e.g., 10.x.x.x) or specific hostnames (*.nexus.internal.corp, artifacts.gitlab.com). Additionally, whitelist URLs containing path parameters typical of build artifacts (e.g., /api/v1/artifacts/.../build-<id>/bin/).

• Endpoint Management & Patch Deployment

  • Scenario: Enterprise endpoint management tools such as Microsoft Intune, Jamf Pro, or Ivanti Endpoint Manager push scheduled updates containing ELF-based executables (common in Linux servers and hybrid environments) to managed devices. During the “Patch Tuesday” window, thousands of agents simultaneously query the central update server for these binaries. The sheer volume of identical requests for new ELF packages can trigger the rule if the update server’s URL is flagged by URLhaus due to a recent reputation change or shared IP with other services.
  • Filter/Exclusion: Exclude traffic originating from known Endpoint Management service accounts (e.g., svc-intune-agent, jamf-prod) and filter for URLs ending in specific versioned paths (