URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary command-and-control (C2) activity by monitoring network traffic against a curated list of known malicious URLs flagged by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the attacker establishes persistent communication channels.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: c2-monitor-auto Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to verify SSL certificates and network reachability. These tools often send requests to known security vendor update servers that URLhaus may flag as “c2-monitor-auto” due to high-volume, automated traffic patterns resembling command-and-control behavior.
  • Filter/Exclusion: Exclude source IP ranges belonging to the internal scanner infrastructure (e.g., 10.50.20.0/24 for Tenable) and filter out URLs containing specific vendor domains known for high-frequency polling, such as *.tenable.com, *.qualys.com, or *.rapid7.com.

• Scenario: Scheduled Software Update Agents

  • Context: Endpoint Management tools like Microsoft Intune, Jamf Pro, or SolarWinds Patch Manager execute scheduled jobs to check for application updates. These agents frequently connect to vendor update repositories (e.g., Microsoft Update, Adobe, Java) which are often tagged by URLhaus as C2 nodes because they maintain persistent connections for telemetry and download manifests.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from the “System” account or specific service accounts running these agents during maintenance windows (e.g., 01:00–05:00 local time). Additionally, exclude URLs matching known update endpoints like *.update.microsoft.com, *.adobe.com, and *.java.com.

• Scenario: Cloud Backup and Synchronization Services

  • Context: Enterprise backup solutions such as **Veeam