URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversary command and control (C2) activity by flagging network traffic to known malicious URLs curated by URLhaus, which are frequently utilized by threat actors for automated monitoring and data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical because early identification of C2 communication allows the SOC team to isolate compromised endpoints before lateral movement or persistent access is established within the environment.

IOC Summary

Threat: c2-monitor-auto Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically contact their cloud management consoles to verify agent health, update policies, or report telemetry. These connections often utilize dynamic IP ranges or subdomains that URLhaus may initially flag as “c2-monitor-auto” due to high traffic volume and new domain registration patterns.
  • Filter/Exclusion: Create a whitelist exclusion for the specific FQDNs of your security management consoles (e.g., *.falcon.crowdstrike.com, *.mdm.microsoftonline.com) or exclude traffic originating from the EDR service accounts on the host level.

• Scenario: Scheduled Patch Management and Software Updates

  • Context: Enterprise patching solutions such as WSUS (Windows Server Update Services), Ivanti Neurons, or Chocolatey initiate background downloads for software updates, drivers, and security definitions. These tools often fetch manifests from vendor repositories that are frequently updated with new subdomains, triggering the rule’s “c2-monitor-auto” tag.
  • Filter/Exclusion: Exclude URLs containing known update repository patterns (e.g., *.update.microsoft.com, *.chocolatey.org) or filter out traffic during specific maintenance windows (e.g., 02:00–04:00 local time) where these scheduled jobs run.

• Scenario: Cloud Backup and Data Synchronization

  • Context: Automated backup agents like Veeam, Rubrik, or Microsoft OneDrive for Business sync large datasets to the cloud. The initial