URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints access known malicious URLs associated with ELF (Executable and Linkable Format) binaries, indicating potential command-and-control communication or malware distribution from Linux-based systems. Proactive hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised workloads and prevent lateral movement before the ELF payloads execute their full attack chain.

IOC Summary

Threat: elf Total URLs: 9 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["205.237.110.232"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["205.237.110.232"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: elf Malicious URLs rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Console Updates via Microsoft Update Catalog

  • Scenario: The Microsoft Defender for Endpoint (or similar EDR) management console automatically downloads definition updates or policy configurations from the go.microsoft.com domain. These URLs often contain dynamic parameters that match the “elf” signature pattern used by URLhaus, specifically when the download package includes embedded ELF binaries for cross-platform agents.
  • Suggested Filter: Exclude traffic originating from the Microsoft Defender Antivirus Service process (MsMpEng.exe) or whitelist the specific subdomain go.microsoft.com combined with the HTTP status code 200.

• Scheduled Java Runtime Environment (JRE) Patching

  • Scenario: A nightly scheduled task (Windows Task Scheduler) triggers a silent update for the Oracle JRE installed on developer workstations. The update mechanism fetches a patch manifest from javadl.oracle.com or update.microsoft.com. If the downloaded archive contains an ELF executable wrapper (common in Linux-to-Windows hybrid deployments), it may trigger the detection even though the source is trusted.
  • Suggested Filter: Create an exclusion for the process javaw.exe or java.exe when accessing URLs containing the path segment /update/, ensuring the destination IP resolves to Oracle’s known ASN (AS31984).

• Internal CI/CD Artifact Retrieval

  • Scenario: An internal Jenkins pipeline executes a build job that pulls pre-compiled Docker images or binary artifacts from an on-premise Nexus Repository Manager. The repository serves these artifacts via URLs tagged with “elf” metadata to indicate executable content types. Since the traffic originates from a trusted internal IP range and targets a known artifact registry, it is