URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are part of a ClearFake campaign, which uses deceptive URLs to lure users into downloading malware. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise of user endpoints and data exfiltration.

IOC Summary

Threat: ClearFake Total URLs: 10 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["dkrxwehc.testpaye.xyz", "vwochim.megaparikade.com", "bxzyp.daneshkhanevade.xyz", "mjwougwp.tarikhravannovin.shop", "amrwjltv.tarikhcheravanshenasi.xyz", "cucnczaq.testdrivepaye3.com", "qqpidjr.megaparikade.com", "fcxkiekt.tasisathosseini.shop", "oxfzzuaq.tasisathosseini.shop", "0dt4r35j.gavaedfagahe.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["dkrxwehc.testpaye.xyz", "vwochim.megaparikade.com", "bxzyp.daneshkhanevade.xyz", "mjwougwp.tarikhravannovin.shop", "amrwjltv.tarikhcheravanshenasi.xyz", "cucnczaq.testdrivepaye3.com", "qqpidjr.megaparikade.com", "fcxkiekt.tasisathosseini.shop", "oxfzzuaq.tasisathosseini.shop", "0dt4r35j.gavaedfagahe.xyz"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator manually enters a ClearFake URL into a ticketing system (e.g., ServiceNow) to test a phishing simulation.
  Filter/Exclusion: Exclude URLs that match known phishing simulation platforms or domains used by internal security teams (e.g., *.phishsim.local, *.testphishing.com).

• Scenario: A scheduled job runs a script that downloads a ClearFake URL as part of a malware analysis workflow (e.g., using Cuckoo Sandbox or VirusTotal API).
  Filter/Exclusion: Exclude URLs that originate from known security research or analysis tools (e.g., *.virus.total, *.cuckoo.org, *.malwr.com).

• Scenario: A user clicks on a ClearFake URL shared in a legitimate internal communication tool (e.g., Microsoft Teams or Slack) during a security awareness training session.
  Filter/Exclusion: Exclude URLs that are associated with internal security training platforms (e.g., training.example.com, securityawareness.example.org).

• Scenario: A backup or sync job (e.g., using rsync or Veeam) temporarily stores files in a cloud storage bucket (e.g., AWS S3) that contains a ClearFake URL in its metadata.
  Filter/Exclusion: Exclude URLs that appear in metadata of files related to backup or sync operations (e.g., *.backup, *.sync, *.rsync).

• Scenario: A DevOps pipeline (e.g., Jenkins, GitLab CI) pushes code to a repository that includes a ClearFake URL in a test script or documentation.
  Filter/Exclusion: Exclude URLs that appear in code repositories or CI/CD pipelines (e.g., *.git, *.ci, *.pipeline, *.jenkinsfile), or match known development tooling domains.