URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversary command and control (C2) communications by monitoring for newly reported malicious URLs from the URLhaus threat intelligence feed to catch early-stage infections or lateral movement. Proactively hunting for these indicators in Azure Sentinel is critical because it enables the SOC team to rapidly isolate compromised endpoints before attackers can establish persistent footholds within the network.

IOC Summary

Threat: c2-monitor-auto Total URLs: 8 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Tool Updates & Telemetry

  • Context: Enterprise security suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query the URLhaus API or internal update servers to fetch threat intelligence feeds. These legitimate HTTP/HTTPS requests often match C2 signatures because they involve high-frequency communication with known security vendors’ domains.
  • Filter/Exclusion: Create a rule exclusion based on Host Process Name. Exclude traffic where process_name matches FalconSensor.exe, MsMpEng.exe, or DefenderService.exe. Additionally, filter out URLs containing specific query parameters like ?action=update or domains ending in .falcon.crowdstrike.com.

• Scenario: Scheduled Software Patching and License Validation

  • Context: Scheduled tasks running via Windows Task Scheduler (e.g., Task Scheduler\Microsoft\Windows\Update) often trigger background processes like wsappx.exe or specific vendor agents (e.g., Ivanti, SCCM) to validate software licenses or download patch manifests. These interactions with external repositories can be flagged as C2 activity due to the nature of the payload exchange.
  • Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 UTC). Alternatively, exclude traffic where process_command_line contains keywords like “license-check”, “patch-manifest”, or specific vendor IDs (e.g., SCCMClient.exe).

• Scenario: Cloud Storage and Collaboration Sync Operations

  • Context: Users utilizing Microsoft OneDrive for Business or Google Drive often initiate background sync sessions that communicate with