URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt targets adversary command and control (C2) activity by identifying connections to a specific set of four malicious URLs known to facilitate automated monitoring and data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of this C2 infrastructure allows the SOC team to isolate compromised endpoints before lateral movement or persistent data theft occurs.

IOC Summary

Threat: c2-monitor-auto Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs rule, tailored for an enterprise environment where legitimate traffic is often misidentified as command-and-control (C2) activity.

• Endpoint Management Agent Heartbeats (Microsoft Intune/SCCM)

  • Scenario: The c2-monitor-auto tag frequently flags the periodic heartbeat and policy synchronization traffic generated by Microsoft Endpoint Configuration Manager (SCCM) or Intune agents. These agents poll specific update servers to check for new policies, which mimics C2 beaconing behavior due to consistent intervals and small payload sizes.
  • Filter/Exclusion: Create a whitelist exclusion for the specific FQDNs associated with the organization’s tenant (e.g., *.manage.microsoft.com, *.configmanager.microsoft.com) or restrict the rule to exclude traffic originating from the “System” user context on managed endpoints during standard business hours.

• Automated Patch Management Scans (Qualys/CrowdStrike)

  • Scenario: Vulnerability scanning tools like Qualys Cloud Agent or CrowdStrike Falcon perform scheduled background scans that connect to their respective cloud control planes to download vulnerability definitions and upload scan results. The c2-monitor-auto logic may interpret these definition downloads as malicious C2 communication, especially if the URLs contain dynamic query parameters typical of API calls.
  • Filter/Exclusion: Implement a filter based on the specific process names (e.g., QualysAgent.exe, FalconSensorService.exe) and exclude known IP ranges or domains belonging to the vendor’s update servers (e.g., *.qualys.com, *.crowdstrike.com).

• Cloud Backup and Synchronization Jobs (Veeam/OneDrive)

  • Scenario: Scheduled backup jobs using Veeam Backup & Replication or Microsoft OneDrive for Business often initiate