URLhaus: c2 Malicious URLs

Hunt Hypothesis

This hunt targets potential Command and Control (C2) communications by identifying traffic to known malicious URLs, indicating that an adversary may be actively directing compromised assets or exfiltrating data. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect stealthy beaconing activity before it escalates into lateral movement or data exfiltration, reducing the mean time to detect (MTTD) for high-severity threats.

IOC Summary

Threat: c2 Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2
let malicious_domains = dynamic(["round-breeze-3e9d.jay-e45.workers.dev", "fancy-rain-e484.0xwilliamortiz.workers.dev", "counterscale.jean-r-mi-larcelet-prost.workers.dev", "claude-exporter-license.nikogdanekupluslona.workers.dev", "captainx-download.captainleontian.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["round-breeze-3e9d.jay-e45.workers.dev", "fancy-rain-e484.0xwilliamortiz.workers.dev", "counterscale.jean-r-mi-larcelet-prost.workers.dev", "claude-exporter-license.nikogdanekupluslona.workers.dev", "captainx-download.captainleontian.workers.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a Java-based ERP system) configured with hardcoded external endpoints for license validation or feature flagging that coincidentally matches one of the C2 URLs due to domain re-registration or typo-squatting.
  • Filter/Exclusion: Exclude source IPs belonging to the specific application server subnet (e.g., 10.20.5.0/24) or filter by User-Agent strings containing LegacyApp/1.0 if the C2 URL is accessed via HTTP GET.
• DevOps Pipeline Artifact Verification: A CI/CD pipeline (e.g., Jenkins or GitLab CI) using a custom script to verify the integrity of downloaded build artifacts by fetching a checksum from a third-party repository or CDN that has been compromised or is using a shared infrastructure IP matching the C2 list.
  • Filter/Exclusion: Exclude traffic from known build agent hostnames (e.g., *.build-agents.corp.local) or filter by the specific HTTP method (POST) if the C2 URL is primarily used for beaconing (GET), and ensure the source port is ephemeral while the destination port is 443/80.
• DNS-Over-HTTPS (DoH) or Proxy Caching: An enterprise proxy or DNS resolver (e.g., Squid or pfSense) caching a response for a malicious URL that was previously accessed by a compromised endpoint, causing subsequent legitimate requests to other internal services to be served from the cache with the malicious URL in the X-Forwarded-For or Referer header, or simply re-serving the cached object.
  • Filter/Exclusion: Exclude traffic where the Cache-Control header indicates a HIT or filter by the proxy’s internal management interface IP range. Alternatively, exclude if the User-Agent