URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are part of a ClearFake campaign, which uses deceptive URLs to deliver malware and steal credentials. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential credential theft and lateral movement attempts by adversaries.

IOC Summary

Threat: ClearFake Total URLs: 7 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["4nd2h8ef.bio90.football", "owxoxg4v.jetbetkade.com", "sjn9cbzs.betvarzeshkade.online", "jqqh90zb.usoleamoozesh.xyz", "7ooj1o3v.tarbiyateslami.xyz", "umusdqbj.hesabdarieskandari.xyz", "s18b1z48.tarahisystem.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["4nd2h8ef.bio90.football", "owxoxg4v.jetbetkade.com", "sjn9cbzs.betvarzeshkade.online", "jqqh90zb.usoleamoozesh.xyz", "7ooj1o3v.tarbiyateslami.xyz", "umusdqbj.hesabdarieskandari.xyz", "s18b1z48.tarahisystem.xyz"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate scheduled job downloading updates from a known ClearFake domain
  Description: A system update or patching tool (e.g., Microsoft Update, SCCM, or Ansible) is configured to download updates from a domain that is falsely flagged as ClearFake.
  Filter/Exclusion: Exclude URLs that match known update servers (e.g., *.update.microsoft.com, *.microsoft.com, *.ansible.com) or use a custom field like url_classification to mark legitimate update sources.

• Scenario: Admin task using ClearFake URLs for internal testing or phishing simulations
  Description: Security teams may use ClearFake URLs as part of a phishing simulation or red team exercise (e.g., using tools like Metasploit, Cobalt Strike, or Attack Simulator).
  Filter/Exclusion: Exclude URLs that match internal testing domains (e.g., *.test.phishing.corp, *.simulator.security.team) or use a tag like is_phishing_simulation in the event data.

• Scenario: Legitimate software distribution via a ClearFake domain
  Description: A third-party software vendor or internal tool (e.g., Jenkins, Docker, or a custom CI/CD pipeline) may use a domain flagged as ClearFake for legitimate software distribution.
  Filter/Exclusion: Exclude URLs that match known software distribution domains (e.g., *.docker.io, *.jenkins.io, *.artifactory.com) or use a field like software_distribution to mark legitimate sources.

• Scenario: False positive from a misconfigured URL filtering tool
  Description: A URL filtering tool (e.g., Cisco Talos, OpenDNS, or Microsoft Defender for Endpoint) may incorrectly flag a legitimate URL as malicious due to a misconfiguration or outdated list.
  Filter/Exclusion: Exclude URLs that are known to be part