URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised hosts establish command and control (C2) communications via known malicious URLs identified by URLhaus’s automated monitoring. Proactively hunting for these specific indicators in Azure Sentinel is critical to rapidly detect early-stage infections and isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Threat: c2-monitor-auto Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Self-Update and Telemetry

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne, frequently initiate background connections to their vendor’s cloud infrastructure. These connections often involve downloading signature updates, configuration policies, or sending telemetry data. URLhaus may flag these high-traffic, automated vendor domains (e.g., *.crowdstrike.com, *.microsoft.com) as “c2-monitor-auto” if they exhibit behavior patterns similar to command-and-control traffic due to their persistent polling mechanisms.
  • Filter/Exclusion: Create an exclusion rule for known EDR vendor IP ranges and specific subdomains used for updates (e.g., update.*.com, telemetry.*.net) within the detection logic, or whitelist these domains in the SIEM correlation engine if they are confirmed as trusted internal infrastructure.

• Scheduled Software Patching via WSUS/SCCM

  • Scenario: Automated patch management systems like Microsoft System Center Configuration Manager (SCCM) or WSUS (Windows Server Update Services) trigger scheduled jobs during off-hours to check for and download critical security patches from Microsoft’s update servers. These interactions involve HTTP/HTTPS requests that mimic C2 polling behavior, often hitting URLhaus-tagged domains associated with software distribution networks that have been previously flagged for benign but “monitor-like” activity.
  • Filter/Exclusion: Implement a time-based filter to exclude alerts generated between 01:00 and 05:00 local time originating from the specific service accounts (e.g., NT AUTHORITY\SYSTEM or `SCCM