URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The detection identifies potential ClearFake malicious URLs that adversaries may use to deliver malware or phishing payloads. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate early-stage attacks before they cause significant damage.

IOC Summary

Threat: ClearFake Total URLs: 14 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["xawur.workoutwithdorci.com", "g6zaqd6k.schleer.hu", "afnsw.wlwyb.com", "igyom.technologiaiviz.hu", "hwujn.welovevent.com", "dkhgk.zaszlorudbolt.hu", "snonc.accredit.hu", "cajya.addmagad.com", "uswai.vikstore.hu", "mrlls.aileadfactory.com", "vggil.yanis.hu", "miixn.wilhelmglobal.com", "2vmkhs7s.riherino.com", "yjkjr.westinvesteuropa.hu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["xawur.workoutwithdorci.com", "g6zaqd6k.schleer.hu", "afnsw.wlwyb.com", "igyom.technologiaiviz.hu", "hwujn.welovevent.com", "dkhgk.zaszlorudbolt.hu", "snonc.accredit.hu", "cajya.addmagad.com", "uswai.vikstore.hu", "mrlls.aileadfactory.com", "vggil.yanis.hu", "miixn.wilhelmglobal.com", "2vmkhs7s.riherino.com", "yjkjr.westinvesteuropa.hu"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator manually enters a ClearFake URL into a ticketing system (e.g., ServiceNow) to test a phishing simulation.
  Filter/Exclusion: Exclude URLs that match known phishing simulation platforms or domains used by security teams (e.g., phishsim.example.com, testphishinglab.com).

• Scenario: A scheduled job runs a script that fetches and processes URLs from a legitimate threat intelligence feed (e.g., URLhaus) for analysis.
  Filter/Exclusion: Exclude URLs that originate from known threat intelligence sources or are part of automated analysis workflows (e.g., urlhaus-api.org, threatintel.example.com).

• Scenario: A user clicks on a ClearFake URL shared in an internal Slack channel as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs that are associated with internal security training platforms (e.g., training.example.com, securityawareness.example.org).

• Scenario: A DevOps pipeline includes a step that validates URLs against a list of known malicious domains for testing purposes.
  Filter/Exclusion: Exclude URLs that are part of CI/CD pipeline testing or validation tools (e.g., test-url-validator.example.com, devsecops-test.example.net).

• Scenario: An admin task runs a script to generate and test benign URLs for a web application security test (e.g., using OWASP ZAP or Burp Suite).
  Filter/Exclusion: Exclude URLs that are generated or used during security testing tools (e.g., zap.example.com, burp-test.example.org or any IP ranges used in internal testing).