URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

The detection identifies potential command and control (C2) activity by monitoring URLs tagged as c2-monitor-auto, which are associated with known malicious infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage adversary access and exfiltration attempts.

IOC Summary

Threat: c2-monitor-auto Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236", "www.dropbox.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236", "www.dropbox.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Scheduled system update via Microsoft Windows Update
  Filter/Exclusion: Exclude URLs containing windowsupdate.microsoft.com or update.microsoft.com
  Rationale: Legitimate system updates often use these domains and may be flagged as C2 activity.

• Scenario: Admin task using PowerShell for log collection
  Filter/Exclusion: Exclude URLs containing logcollection or logstash in the URL path
  Rationale: Admins may use PowerShell scripts to collect logs, which can generate traffic to internal or external log aggregation tools.

• Scenario: Automated backup job using Veeam or Acronis
  Filter/Exclusion: Exclude URLs containing backup, veeam, or acronis in the URL path
  Rationale: Backup tools often communicate with remote servers for data transfer, which may be misclassified as C2.

• Scenario: Internal monitoring tool like Splunk or Datadog
  Filter/Exclusion: Exclude URLs containing splunk, datadog, or logs in the domain or path
  Rationale: These tools are commonly used for internal monitoring and may generate traffic to their respective monitoring endpoints.

• Scenario: Automated deployment using Ansible or Jenkins
  Filter/Exclusion: Exclude URLs containing ansible, jenkins, or ci in the domain or path
  Rationale: CI/CD pipelines often interact with remote servers for artifact retrieval, which can be flagged as suspicious C2 activity.