URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt detects adversary command and control (C2) activity by identifying traffic to known malicious URLs flagged by URLhaus’s automated monitoring system. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints before adversaries establish persistent communication channels or exfiltrate sensitive data.

IOC Summary

Threat: c2-monitor-auto Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs rule, along with targeted filters and exclusions:

• Automated Security Scanner Traffic: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe public endpoints to verify SSL certificates or check for known signatures. These tools often generate HTTP requests to URLs that URLhaus has flagged as “c2-monitor-auto” due to previous activity, even though the current traffic is benign scanning noise.

  • Filter/Exclusion: Create a rule exclusion based on the Source IP range of internal scanner appliances or filter out events where the User-Agent string contains specific keywords like “Nessus”, “Qualys”, or “Rapid7”.

• Cloud Backup and Synchronization Services: Enterprise data protection tools (e.g., Veeam, Rubrik, or Microsoft OneDrive for Business) perform scheduled synchronization jobs that contact external update servers or cloud storage endpoints. These services often utilize shared CDN URLs that URLhaus may tag as C2 infrastructure due to high global traffic volume, triggering the rule during routine backup windows.

  • Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the Destination Domain matches known cloud provider domains (e.g., *.veeam.com, *.microsoftonline.com) and the process name is a recognized backup agent.

• Software Update Mechanisms: Critical enterprise applications such as Adobe Acrobat, Zoom, or Microsoft Office run background update agents that query vendor repositories for patches. These repositories often host URLs that are dynamically tagged by threat intelligence feeds as C2 nodes because they serve millions of global clients, leading to false positives during the daily “update check” cycle.