URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This rule detects potential Command and Control (C2) activity by identifying traffic to known malicious URLs associated with the “c2-monitor-auto” tag, indicating an adversary is establishing or maintaining a covert communication channel. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints before they can exfiltrate data or receive further instructions, thereby reducing the dwell time of high-severity threats.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Automated Patch Management and Compliance Scans: Enterprise endpoint management agents (e.g., Microsoft Endpoint Configuration Manager, Ivanti, or SCCM) often poll specific vendor endpoints or third-party update servers to check for new patches or compliance baselines. If a known URL from the c2-monitor-auto tag is used by a legitimate update service or if a compromised vendor endpoint is temporarily listed, agents running scheduled “Update Scan” jobs may trigger the rule.

  • Filter/Exclusion: Exclude traffic from known management agent service accounts (e.g., svc-ccm, svc-ivanti) or specific management server IP ranges when the destination URL matches the known benign vendor domain associated with the update cycle.

• CI/CD Pipeline Artifact Retrieval: In DevOps environments, build agents (e.g., Jenkins, Azure DevOps, GitHub Actions runners) frequently fetch build artifacts, container images, or configuration files from internal artifact repositories (e.g., Nexus, Artifactory, or S3 buckets). If a build script dynamically constructs a URL to fetch a specific package version that coincidentally matches a URLhaus entry (perhaps due to a shared CDN or a temporary misclassification), the agent’s wget or curl commands will trigger the detection.

  • Filter/Exclusion: Exclude processes initiated by CI/CD agent binaries (e.g., jenkins-agent.exe, azdoagent.exe, docker-cli) or restrict the rule to non-DevOps host groups.

• Legacy Application License Validation: Older enterprise applications (e.g., legacy ERP modules, specialized CAD tools, or financial modeling software) may perform periodic license checks against a vendor’s licensing server. If the vendor uses a shared hosting provider or a URL that has been recently flagged by URLhaus for a different campaign, the application’s background service (e.g., liccheck.exe, license_mgr.dll) will