URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This rule detects potential Command and Control (C2) infrastructure by identifying traffic to known malicious URLs, indicating that an adversary may be actively communicating with or exfiltrating data from compromised assets. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify lateral movement or persistent access before the adversary can establish a foothold or escalate privileges within the environment.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a microservice, where the build agent fetches dependencies or configuration files from a temporary staging server that shares an IP or domain with a known C2 node.
  • Filter/Exclusion: Exclude traffic from known CI/CD runner subnets (e.g., 10.20.0.0/24) or specific service accounts (e.g., svc-ci-runner) when the destination URL matches the pattern https://[ip]/api/v1/ or similar API paths, provided the source port is 443 and the user-agent contains Jenkins or GitHub-Actions.
• Scenario: An internal monitoring tool (e.g., Datadog, New Relic, or custom Python scripts) performs a health check or data ingestion request to a third-party SaaS endpoint that has been temporarily flagged by URLhaus due to a shared infrastructure provider (e.g., a compromised AWS EC2 instance used for both C2 and legitimate API hosting).
  • Filter/Exclusion: Exclude requests where the User-Agent header contains DatadogAgent, NewRelic, or python-requests, and the HTTP method is POST or PUT (indicating data submission rather than simple GET-based beaconing), specifically for URLs ending in /v1/checks or /api/ingest.
• Scenario: A legacy application or scheduled job (e.g., a nightly backup script using curl or wget) fetches a configuration file or license key from a vendor’s update server that has been recently added to URLhaus due to a transient compromise or misclassification.
  • Filter/Exclusion: Exclude traffic from specific scheduled task accounts (e.g., svc-backup, `svc-license-check