URLhaus: elf Malicious URLs

Hunt Hypothesis

This detection targets adversary behavior involving the execution of ELF binaries delivered via known malicious web endpoints, indicating potential lateral movement or initial access through compromised software repositories. Proactively hunting for these specific URL patterns in Azure Sentinel is critical to identify early-stage threats before they establish persistence, leveraging the high-fidelity threat intelligence from URLhaus to reduce false positives and accelerate incident response.

IOC Summary

Threat: elf Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: elf
let malicious_domains = dynamic(["217.60.195.187", "45.207.196.86"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.60.195.187", "45.207.196.86"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: elf Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Supply Chain Updates via JFrog Artifactory

  • Scenario: The organization uses JFrog Artifactory to host internal build artifacts. When the CI/CD pipeline (e.g., GitLab Runner) executes a scheduled nightly job to pull new elf binary packages or update metadata, it triggers a high volume of requests to URLs containing “elf” in the path or query parameters. If these internal artifact repositories are hosted on subdomains that share naming conventions with known malware families, they may be flagged by URLhaus as suspicious.
  • Suggested Filter: Exclude traffic originating from the CI/CD Service Account IP range (e.g., 10.20.50.0/24) destined for internal artifact repository domains (e.g., *.artifactory.local or specific S3 buckets) where the URL path contains /elf/.

• Endpoint Security Agent Self-Healing and Definition Sync

  • Scenario: The enterprise endpoint protection suite, such as CrowdStrike Falcon or SentinelOne, performs a scheduled self-healing task every morning at 08:00. During this window, the agent queries its vendor’s update servers to download specific elf signature definitions and executable patches. If the detection logic strictly matches the string “elf” without context, these legitimate vendor communication URLs (e.g., updates.crowdstrike.com/.../elf-signatures) may be flagged as malicious if the URLhaus database has recently tagged similar patterns from a different threat actor.
  • Suggested Filter: Create an exclusion for traffic generated by the Endpoint Security Agent process (e.g., csagent.exe