URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt targets adversary command and control (C2) activity by identifying traffic to specific malicious URLs flagged by URLhaus as automated C2 monitoring endpoints. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of such C2 channels can reveal active lateral movement or data exfiltration before the malware establishes a persistent foothold within the network.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Automated Patch Management Scans

  • Scenario: The organization’s endpoint management solution (e.g., Microsoft Intune, Ivanti, or Jamf) performs scheduled background scans to check for the latest security patches. These agents frequently query vendor update servers that host dynamic content delivery networks (CDNs). If a specific CDN node has recently been flagged by URLhaus due to a transient issue or shared IP reputation, legitimate patch check requests from hundreds of endpoints will trigger this rule simultaneously.
  • Filter/Exclusion: Create an exclusion for the specific source process names associated with the management agent (e.g., Microsoft.Update.Service.exe, JamfAgent.exe) and whitelist the known vendor update domains (e.g., *.microsoft.com, updates.ivanti.com).

• IT Admin Manual Troubleshooting via Browser

  • Scenario: During a scheduled maintenance window, IT administrators manually investigate network latency or service health by accessing internal dashboards hosted on public cloud infrastructure. If an admin navigates to a third-party status page (e.g., AWS Health Dashboard, Azure Status Center, or a SaaS vendor’s “System Status” portal) that URLhaus has tagged as c2-monitor-auto due to its high-volume, automated traffic patterns, the rule will flag these legitimate administrative browsing sessions.
  • Filter/Exclusion: Implement a user-based exclusion for the IT Operations and Security Admin security groups. Additionally, add an allow-list for specific URL paths commonly used for status monitoring (e.g., *.statuspage.io, /health-check endpoints).

• Scheduled Log Aggregation and Backup Jobs

  • **Scenario