URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This rule detects adversary command and control (C2) activity by identifying traffic to a set of seven auto-tagged malicious URLs known to facilitate remote access and data exfiltration. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints before attackers establish persistent communication channels that could lead to lateral movement or sensitive data theft.

IOC Summary

Threat: c2-monitor-auto Total URLs: 7 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule, along with suggested filters and exclusions:

• Automated Security Scanner Traffic

  • Scenario: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to validate firewall rules or scan for open ports. These tools often initiate connections to known C2 infrastructure URLs used by the scanner vendor’s cloud management plane, which URLhaus may flag as generic “monitor-auto” traffic due to high connection volume and specific payload patterns.
  • Filter/Exclusion: Exclude source IPs belonging to the security scanning appliance subnets (e.g., 10.50.20.0/24) or filter out URLs containing vendor-specific domains like *.tenable.com or *.qualys.com.

• Scheduled Cloud Backup and Sync Jobs

  • Scenario: Automated backup agents running on file servers (e.g., Veeam, Rubrik, or Microsoft Azure Backup) execute scheduled jobs that communicate with cloud storage gateways. These connections often utilize standard HTTPS endpoints tagged by URLhaus as monitoring infrastructure, especially when the backup software performs health checks against remote C2 nodes before initiating data transfer.
  • Filter/Exclusion: Create a whitelist for specific service accounts or hostnames associated with backup agents (e.g., VeeamBackupService, AzureBackupAgent) and exclude traffic occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Endpoint Management & Patching Orchestration

  • Scenario: Configuration management tools like Microsoft Intune, Jamf Pro, or SCCM (Configuration Manager) regularly poll central management servers to download policy updates, inventory data