URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries establishing command-and-control channels through known malicious URLs, a behavior that often precedes data exfiltration or lateral movement. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised assets early, reducing the dwell time of threats that may otherwise evade standard signature-based detections.

IOC Summary

Threat: c2-monitor-auto Total URLs: 4 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a staging environment to test a new microservice that dynamically generates API endpoints or callback URLs for load balancing, which may coincidentally match the hash or structure of a known C2 URL.
  • Filter/Exclusion: Exclude traffic where the User-Agent string contains Postman or curl and the destination IP belongs to the internal 10.0.0.0/8 staging subnet, or specifically exclude the staging-api-gateway service account.
• Scenario: An automated compliance audit script (e.g., using Ansible or Chef) fetches a list of approved external resources or vulnerability signatures from a public repository, and one of the URLs in the manifest matches a known malicious entry due to a shared path structure or temporary hosting overlap.
  • Filter/Exclusion: Exclude alerts where the source process is python.exe or node.exe running under the compliance-audit scheduled task, and the destination domain is in the raw.githubusercontent.com or cdn.jsdelivr.net allowlist.
• Scenario: A marketing team uses a third-party link shortener service (e.g., bit.ly or t.ly) for a campaign, and the shortened URL resolves to a landing page that has been temporarily compromised or is hosted on a server that shares a C2 tag in the URLhaus database due to a recent takedown or misconfiguration.
  • Filter/Exclusion: Exclude alerts where the User-Agent contains Mozilla/5.0 (browser traffic) and the source IP is within the Marketing-Team VLAN, or specifically exclude domains bit.ly and t.ly if the HTTP status code is 200 and the content-type is text/html.
• Scenario: A legacy application update script downloads a configuration file from a