URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt detects adversary command and control (C2) activity by identifying traffic to known malicious URLs flagged by URLhaus as part of an automated monitoring feed. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify compromised hosts communicating with active C2 infrastructure, thereby reducing dwell time before lateral movement or data exfiltration occurs.

IOC Summary

Threat: c2-monitor-auto Total URLs: 6 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Security Tools

  • Context: Enterprise vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM frequently probe external endpoints to check for known threats. These tools often query URLhaus APIs directly or scan URLs that have been recently flagged but are safe in the context of the scanner’s internal traffic, triggering a C2 alert due to the sheer volume of requests.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., Tenable-Scanner-01, Qualys-Central) or filter out traffic where the User-Agent string contains specific vendor identifiers (e.g., *Nessus*, *Qualys*).

• Scenario: Scheduled Backup and Synchronization Jobs

  • Context: Automated backup solutions such as Veeam, Rubrik, or cloud sync tools like OneDrive for Business and SharePoint Online perform scheduled connectivity checks. These jobs often initiate outbound connections to URLhaus endpoints to verify network reachability or fetch update manifests, which can be misidentified as C2 beaconing traffic due to the regularity of the connection intervals.
  • Filter/Exclusion: Exclude traffic originating from specific Service Accounts (e.g., svc-veeam-backup, svc-sharepoint-sync) running on dedicated backup servers. Alternatively, filter based on the Destination Port if these tools use non-standard ports distinct from typical web browsing (e.g., port 8443 or 9001).

• Scenario: Software Update and Patch Management Cycles

  • **Context