URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging known malicious command and control (C2) infrastructure by monitoring traffic against the real-time URLhaus threat intelligence feed to intercept active threats before they compromise endpoints. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected resources and prevent lateral movement, as automated C2 communications often serve as the initial foothold for broader ransomware or data exfiltration campaigns.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) automatically pull the latest threat intelligence feeds from vendor cloud repositories. These URLs often contain dynamic parameters or hash values that may be flagged as “suspicious” by URLhaus due to high entropy or recent registration dates.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from internal jump hosts or specific service accounts (e.g., svc-av-updater) accessing known vendor domains such as *.crowdstrike.com, *.microsoft.com, and *.eset.com.

• Scenario: Automated CI/CD Pipeline Artifact Downloads

  • Context: DevOps pipelines running on platforms like Jenkins, GitLab Runners, or Azure DevAgents frequently download build artifacts, container images, or dependency libraries from cloud storage buckets (e.g., AWS S3, Azure Blob Storage). These URLs often include long query strings and temporary tokens that mimic Command & Control (C2) beaconing patterns.
  • Filter/Exclusion: Exclude traffic where the source process is a known CI/CD runner (e.g., java.exe running as jenkins-agent, dotnet.exe for Azure Pipelines) connecting to internal artifact registries or specific cloud storage endpoints like s3.amazonaws.com and *.azureedge.net.

• Scenario: Enterprise Search Engine Indexing Crawls

  • Context: Internal search solutions (e.g., Microsoft SharePoint, Elasticsearch clusters, or Splunk Universal Forwarders) periodically crawl internal documentation portals and external knowledge bases. The crawler agents generate high-volume HTTP requests to various