URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt targets potential Command and Control (C2) infrastructure by identifying assets that have communicated with known malicious URLs flagged for automated monitoring. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect compromised endpoints or lateral movement attempts before adversaries can fully establish persistent connections or exfiltrate data.

IOC Summary

Threat: c2-monitor-auto Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a browser-based URL shortener or a temporary file sharing service (e.g., file.io, transfer.sh, or a corporate instance of sharable.io) to share large log files or configuration dumps with a vendor. If the specific short URL generated happens to match one of the three known malicious hashes in the URLhaus feed (a rare but possible collision if the feed includes generic shorteners or if the “malicious” tag is a false positive in the source data), the rule will trigger.
  • Filter/Exclusion: Exclude URLs where the domain is in the approved list of internal file-sharing or shortening services (e.g., *.fileshare.corp.com, *.sharable.io) and the user agent is a standard browser (Chrome, Edge, Firefox) rather than a script or agent.
• Scenario: A security team or IT support staff manually tests a newly deployed web application or API endpoint by accessing a staging environment URL that has been temporarily registered in a public URL monitoring service (like URLhaus) for validation. If the staging URL is identical to one of the three malicious URLs in the feed (perhaps due to a reused IP or domain in a test environment), the rule triggers.
  • Filter/Exclusion: Exclude URLs where the source IP is from the internal staging network range (e.g., 10.20.0.0/16) and the user account belongs to the IT-Testing or SecOps security group.
• Scenario: An automated backup or snapshot job (e.g., Veeam, Commvault, or AWS Backup) generates a report or metadata file that includes a reference to a URL for a cloud storage bucket or a monitoring endpoint. If this URL is a known public endpoint that has been tagged as c2-monitor-auto in URLhaus (possibly due