URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversary command and control (C2) activities by monitoring for newly identified malicious URLs from the URLhaus threat intelligence feed, which often signal early-stage malware infections or active data exfiltration attempts. Proactive hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints before adversaries can establish persistent access or pivot deeper into the network infrastructure.

IOC Summary

Threat: c2-monitor-auto Total URLs: 7 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Security Tool Updates

  • Context: Endpoint protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or vulnerability scanners (e.g., Tenable Nessus) frequently query the URLhaus API directly to fetch the latest threat intelligence feeds. These legitimate API calls often contain dynamic parameters that resemble C2 beacon traffic.
  • Filter/Exclusion: Create a rule exclusion based on Source Host Group (e.g., Security-Infrastructure-Servers) or filter by specific destination URLs containing /api/v1/ in the path, ensuring only internal security appliances trigger this logic.

• Scenario: Scheduled Cloud Backup and Sync Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or cloud sync tools like OneDrive for Business / SharePoint Online initiate scheduled jobs that upload large datasets to external storage endpoints. These uploads often involve long-duration connections with intermittent packet bursts, mimicking the heartbeat patterns of C2 channels.
  • Filter/Exclusion: Exclude traffic where the Destination Domain matches known cloud providers (e.g., *.office365.com, *.veeam.com) and restrict the alert to business hours or specific time windows defined in the scheduled job configuration.

• Scenario: Developer CI/CD Pipeline Artifacts

  • Context: DevOps teams using platforms like Jenkins, GitHub Actions, or Azure DevOps execute build pipelines that pull dependencies, scan container images, and push artifacts to external registries (e.g., Docker Hub, AWS ECR). These processes generate high-volume outbound traffic with unique URLs that may be flagged as suspicious by generic C2