URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This rule detects adversaries leveraging automated feeds from URLhaus to identify and block malicious command-and-control (C2) endpoints that may evade static signature-based defenses. A SOC team should proactively hunt for these indicators in Azure Sentinel because C2 channels are frequently used as the initial foothold for lateral movement and data exfiltration, requiring real-time visibility beyond passive alerting.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule, including targeted filters and exclusions:

• Scheduled Security Scanner Updates

  • Scenario: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) runs a daily scheduled job at 03:00 AM to download the latest threat intelligence feeds. These scanners often query URLhaus directly or pull from a CDN that hosts the same malicious signatures, triggering the rule when the scanner’s service account accesses the https://urlhaus-api.abusix.com endpoint.
  • Filter/Exclusion: Exclude traffic originating from the specific Service Account (e.g., svc-security-updater) and restrict the exclusion to the specific destination IP range of the URLhaus API or the vendor’s update server.

• IT Admin Manual Threat Research

  • Scenario: Security analysts in the SOC manually investigate a new alert by navigating directly to the URLhaus website (https://urlhaus.abusix.com) via their corporate browser (e.g., Google Chrome Enterprise) to review hash details and download sample reports. The rule interprets this legitimate browsing activity as a potential C2 beacon because the URL contains known malicious indicators within its structure.
  • Filter/Exclusion: Create an exclusion for traffic generated by user groups tagged as SOC-Analysts or Security-Admins when accessing the domain urlhaus.abusix.com, regardless of the specific path or query parameters.

• Cloud Backup and Synchronization Jobs

  • Scenario: The organization uses Veeam Backup & Replication to perform incremental backups to a cloud repository. During the backup window, Veeam’s agent queries external metadata services that include URLhaus references to validate file integrity against known malware signatures