URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of known Command and Control (C2) infrastructure by identifying traffic to malicious URLs associated with the “c2-monitor-auto” tag, which often indicates automated beaconing or data exfiltration attempts. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect compromised endpoints or lateral movement before the adversary establishes a persistent foothold or escalates privileges within the environment.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a microservice, where the build script fetches dependencies or configuration files from a staging repository hosted on a domain that has been recently flagged by URLhaus due to a shared IP or temporary compromise.

  • Filter/Exclusion: Exclude traffic where the source is a known CI/CD runner IP range or process (e.g., docker, jenkins-agent, github-actions) and the destination port is 443, provided the user agent header matches standard HTTP clients (e.g., curl, wget, python-requests).

• Scenario: An IT administrator performs a manual backup verification using a third-party backup tool (e.g., Veeam, Commvault, or Acronis) that connects to a remote cloud storage endpoint or license server. The specific URL path used for the license check or metadata sync coincides with a known C2 URL pattern in the URLhaus database, even though the connection is encrypted and initiated by a trusted service account.

  • Filter/Exclusion: Exclude alerts where the initiating process is a known backup/management agent (e.g., veeam.exe, commvault_agent.exe) and the destination domain is in the approved vendor list (e.g., *.veeam.com, *.commvault.com), regardless of the specific URL path.

• Scenario: A network monitoring tool (e.g., PRTG, Nagios, or Zabbix) performs an active HTTP/HTTPS check on a web application endpoint to verify uptime. The check includes a specific query string or path (e.g., /api/health?token=abc123) that matches a malicious URL signature in URLhaus, often because the tool uses a generic or predictable URL structure that overlaps with known C2 patterns. *