URLhaus: c2-monitor-auto Malicious URLs

Hunt Hypothesis

This hunt targets adversary command and control (C2) activities where compromised hosts communicate with known malicious infrastructure identified by URLhaus’s automated monitoring. Proactively hunting these specific C2 indicators in Azure Sentinel is critical to rapidly detect early-stage lateral movement or data exfiltration before they escalate into full-scale incidents.

IOC Summary

Threat: c2-monitor-auto Total URLs: 7 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: c2-monitor-auto
let malicious_domains = dynamic(["91.92.242.236"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.242.236"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: c2-monitor-auto Malicious URLs rule in an enterprise environment, along with targeted mitigation strategies:

• Automated Software Update Checks by Patch Management Tools

  • Scenario: Enterprise patch management solutions like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons frequently poll update repositories to check for new definitions. These tools often query URLs hosted on subdomains of major vendors (e.g., update.microsoft.com, download.ivanti.com) that may have been recently flagged by URLhaus due to shared IP ranges with active C2 campaigns, even though the specific endpoints accessed are benign.
  • Filter/Exclusion: Create an exclusion for traffic originating from known patch management service accounts (e.g., svc_sccm_agent, Ivanti_Service) accessing URLs containing keywords like /update, /catalog, or /manifest within the first 15 minutes of a scheduled maintenance window.

• Scheduled Cloud Backup and Synchronization Jobs

  • Scenario: Automated backup agents such as Veeam Backup & Replication, Rubrik, or AWS DataSync initiate daily synchronization tasks that connect to cloud storage endpoints. These connections often traverse dynamic DNS entries (e.g., s3.amazonaws.com, blob.core.windows.net) which URLhaus may tag as suspicious due to the high volume of traffic and shared infrastructure with known C2 actors, despite the traffic being legitimate data transfer.
  • Filter/Exclusion: Exclude traffic from backup service accounts (e.g., vbr_backup_svc, aws-data-sync-agent) where the destination URL path contains standard API endpoints like /api/v1/sync, /bucket/upload, or specific S3 bucket prefixes defined in the organization’s asset inventory.

• Compliance and Security Scanner Heartbeats