URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversary command and control (C2) activity by flagging network traffic to URLs dynamically classified as malicious by the URLhaus threat intelligence feed. Proactively hunting for these indicators in Azure Sentinel is critical because C2 channels are often used early in an attack lifecycle to establish persistent access, allowing the SOC team to intercept potential data exfiltration or lateral movement before full compromise occurs.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Threat Intelligence Feed Updates via SIEM Connector

  • Context: The organization’s Security Information and Event Management (SIEM) system, such as Splunk Enterprise Security or Microsoft Sentinel, runs a scheduled hourly job to fetch the latest URLhaus threat feed directly from urlhaus-api.checkpoint.com or similar endpoints. These API calls often contain dynamic query parameters that match the “c2-monitor-auto” signature pattern but are purely administrative data ingestion tasks.
  • Suggested Filter/Exclusion: Create an exclusion rule targeting traffic where the Source Host matches the SIEM’s internal IP range (e.g., 10.50.10.0/24) AND the Destination URL contains the path segment /api/v1/feed. Alternatively, exclude any HTTP GET requests originating from the specific service account used by the SIEM connector (e.g., svc-siem-updater).

• Scenario: Endpoint Protection Cloud Communication for Policy Sync

  • Context: Enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Carbon Black initiate background connections to their cloud management console to synchronize detection policies and update malware signatures. These agents often utilize generic C2-like communication patterns that URLhaus flags as “c2-monitor-auto” due to the high frequency of small, encrypted payloads typical of policy syncs.
  • Suggested Filter/Exclusion: Implement a filter based on the Process Name initiating the connection. Exclude alerts where the process is falcon-sensor.exe, SentinelOneAgent.exe, or cbagent.exe connecting to known vendor domains (e.g., `*.crowdstrike.com