URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversary command and control (C2) activity by monitoring traffic to a curated set of five auto-tagged malicious URLs known for facilitating remote access and data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly identify compromised endpoints engaging with newly observed C2 infrastructure before they can establish persistent footholds or initiate lateral movement within the network.

IOC Summary

Threat: c2-monitor-auto Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: c2-monitor-auto Malicious URLs”

• Scenario 1: Automated Endpoint Security Updates

  • Context: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) initiates a scheduled daily update cycle. The agent connects to the vendor’s cloud repository to download definition signatures and policy updates, which often involve dynamic URLs that URLhaus may flag as new C2 traffic due to their high-volume nature.
  • Suggested Filter: Exclude traffic originating from specific IP ranges of the security vendor (e.g., 13.x.x.x for CrowdStrike) or filter by the process name falcon.sys / MsMpEng.exe when the destination URL contains known update domains like *.crowdstrike.com or *.microsoft.com.

• Scenario 2: Scheduled Backup and Cloud Synchronization Jobs

  • Context: A nightly scheduled backup job using tools like Veeam, Rubrik, or Microsoft Azure Backup runs during off-hours. These jobs establish persistent connections to cloud storage gateways (e.g., AWS S3, Azure Blob) to upload data chunks. The continuous stream of small HTTP/HTTPS requests to these gateways can mimic the heartbeat pattern of a C2 botnet.
  • Suggested Filter: Create an exclusion for traffic generated by backup service accounts or specific scheduled tasks (e.g., Veeam.Backup.Service.exe) connecting to known cloud storage endpoints, specifically filtering out URLs containing paths like /api/v1/upload or /blob.

• Scenario 3: IT Admin Remote Management and Patching

  • Context: System administrators utilize remote management tools such as Microsoft SCCM (Configuration Manager), Jamf, or Ivanti to