URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversary command and control (C2) activity by flagging traffic to URLs dynamically classified as malicious by the URLhaus threat intelligence feed. Proactive hunting for these indicators in Azure Sentinel is critical because automated C2 monitoring allows the SOC team to rapidly isolate compromised endpoints before lateral movement or data exfiltration occurs.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: c2-monitor-auto Malicious URLs detection rule:

• Scenario: Automated vulnerability scanning by enterprise security tools.

  • Context: Tools like Tenable Nessus, Qualys, or Rapid7 InsightVM periodically scan internal assets and external endpoints to check for known threats. These scanners often query URLhaus APIs or fetch threat intelligence feeds that contain C2 signatures, triggering the rule when they pull data from urlhaus-api domains or specific feed URLs tagged as “c2-monitor-auto”.
  • Filter/Exclusion: Exclude traffic originating from the IP ranges of known vulnerability management servers (e.g., 10.50.10.0/24) and filter out user agents containing keywords like Nessus, QualysGuard, or Rapid7.

• Scenario: Scheduled backup and synchronization jobs accessing cloud repositories.

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik often perform scheduled tasks to sync metadata with their management consoles or S3 buckets. If the backup software queries a URL that has been recently flagged by URLhaus due to a new C2 signature (even if benign in this context), it triggers an alert during the nightly maintenance window.
  • Filter/Exclusion: Create an exclusion for traffic occurring between 01:00 and 05:00 UTC from hosts running Veeam or Rubrik services, specifically targeting destination URLs ending in .cloud.vvmware.com or specific S3 bucket endpoints used by the backup infrastructure.

• Scenario: Admin-initiated patch management and software deployment workflows.

  • Context: During system maintenance windows, administrators use tools like Microsoft Endpoint Configuration Manager (MECM/SCCM)