URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver malware or exfiltrate data, leveraging known malicious domains to compromise endpoints. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromise early, especially given the high severity and prevalence of ClearFake in targeted attacks.

IOC Summary

Threat: ClearFake Total URLs: 17 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["viopkdh.kbshavanese.com", "npawoli.jamjahani.world", "rxxgnn.jamjahani.cash", "7tzr8pjb.mattheneus-healthcare.com", "hetljl.jamjahani.football", "enkkxbi.n1betiran.com", "dbnnsjv.mangobetfarsi.com", "fgeszrs.dahdahtoys.com", "yghqghh.lolsurpriseball.com", "xvbfkf.jamjahani.app", "ybyvozc.jamjahani.vip", "s3unirpm.bet90land.com", "rvlpcvr.jogodobicho.games", "is34r2fh.marc90bet.com", "eycgzaa.jamjahani.site", "xhqkuit.kvbel.com", "zqgqzuo.mangobetfarsi.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["viopkdh.kbshavanese.com", "npawoli.jamjahani.world", "rxxgnn.jamjahani.cash", "7tzr8pjb.mattheneus-healthcare.com", "hetljl.jamjahani.football", "enkkxbi.n1betiran.com", "dbnnsjv.mangobetfarsi.com", "fgeszrs.dahdahtoys.com", "yghqghh.lolsurpriseball.com", "xvbfkf.jamjahani.app", "ybyvozc.jamjahani.vip", "s3unirpm.bet90land.com", "rvlpcvr.jogodobicho.games", "is34r2fh.marc90bet.com", "eycgzaa.jamjahani.site", "xhqkuit.kvbel.com", "zqgqzuo.mangobetfarsi.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a URL shortener service (e.g., Bitly) to verify its behavior in a sandbox environment.
  Filter/Exclusion: Exclude URLs containing the domain bitly.com or any known URL shortening service domains.

• Scenario: A scheduled job runs a script to fetch updates from a trusted internal repository (e.g., GitLab CI/CD pipeline) using a URL that matches the ClearFake pattern.
  Filter/Exclusion: Exclude URLs that match the internal repository domain (e.g., *.gitlab.com) or use a custom field like source:internal.

• Scenario: A developer is using a tool like curl or wget to download a legitimate software update from a known vendor (e.g., Microsoft, Adobe) during a patching process.
  Filter/Exclusion: Exclude URLs that contain vendor-specific domains (e.g., *.microsoft.com, *.adobe.com) or include query parameters like ?download=true.

• Scenario: A security team member is using a tool like Wireshark or tcpdump to capture and analyze network traffic, which includes legitimate URLs being accessed by internal applications.
  Filter/Exclusion: Exclude traffic originating from known security tools or internal monitoring systems (e.g., source_ip:10.0.0.0/8).

• Scenario: A backup process uses a script to transfer data to a cloud storage service (e.g., AWS S3, Azure Blob Storage) using a URL that matches the ClearFake pattern.
  Filter/Exclusion: Exclude URLs that include cloud storage service domains (e.g., *.s3.amazonaws.com, *.blob.core.windows.net) or use a custom field like action:backup.