URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This rule detects adversaries leveraging automated feeds from URLhaus to identify and block command-and-control (C2) traffic associated with known malicious URLs. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints before they establish persistent communication with external threat actors, thereby reducing the window for lateral movement and data exfiltration.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Security Tool Telemetry & Updates

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently query the URLhaus API to check file hashes and download definition updates. These queries often hit URLs that are dynamically generated or contain long, complex parameters which can resemble C2 beacon traffic.
  • Filter/Exclusion: Create a rule exclusion based on the Source Hostname or Process Name. Exclude any traffic where process_name matches *FalconSensor.exe, *MsMpEng.exe, or *cbcmd.exe. Alternatively, whitelist specific URLhaus API endpoints (e.g., api.urlhaus.info) in the detection logic.

• Scenario: Scheduled Software Deployment & Patching Jobs

  • Context: Enterprise patch management tools such as Microsoft SCCM, Ivanti Neurons, or Jamf Pro run scheduled jobs during off-hours to download patches and configuration manifests from vendor repositories. These downloads often traverse through intermediate redirect URLs that may be flagged as suspicious by the C2 monitor due to high entropy in the URL string.
  • Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00 - 06:00 UTC). Additionally, add an exclusion filter for traffic originating from specific Service Accounts (e.g., DOMAIN\SCCM-Deploy-SVC) or destination domains belonging to major software vendors (e.g., *.microsoft.com, *.jamfsoftware.com).

• Scenario: Cloud Backup and Synchronization Services

  ---