URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt detects adversary command and control (C2) communications by identifying traffic to three specific malicious URLs flagged by URLhaus as active C2 monitoring endpoints. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of such C2 channels allows the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Threat: c2-monitor-auto Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager frequently scan endpoints against the URLhaus database to verify the integrity of software repositories. During a scheduled nightly maintenance window, these agents may query known “malicious” URLs that are actually part of a vendor’s update feed but flagged by the community due to historical behavior or aggressive heuristics.
  • Suggested Filter: Exclude traffic originating from specific Service Accounts (e.g., svc-patch-agent) and restrict the rule scope to exclude destination ports commonly used for internal repository synchronization (e.g., port 443 traffic where the User-Agent header contains “SCCM” or “Ivanti”).

• Scenario: Security Information and Event Management (SIEM) Enrichment

  • Context: The organization’s SIEM platform, such as Splunk Enterprise Security or Microsoft Sentinel, runs a scheduled job to enrich incoming logs by cross-referencing external threat intelligence feeds. This process involves the SIEM engine actively probing URLs identified in the c2-monitor-auto tag to update its local threat database, triggering the detection rule even though no human user is involved and the traffic is purely analytical.
  • Suggested Filter: Create an exclusion for source IPs belonging to the SIEM Management Cluster (e.g., 10.50.20.0/24) and filter out events where the HTTP User-Agent string matches known SIEM enrichment agents (e.g., “Splunk-HTTPClient” or “Azure-Sentinel-Prober”).

• **Scenario: Web Proxy