URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver malware or phishing payloads, leveraging compromised or spoofed domains to compromise user credentials or systems. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise early, especially since ClearFake URLs are often used in targeted attacks and may evade traditional detection methods.

IOC Summary

Threat: ClearFake Total URLs: 8 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["cdn.jsdelivr.net", "drf.honareslami.xyz", "wlwnophi.313betiran.online", "00pq7d1j.1xboropartners.com", "rfhudhbz.313betsingup.casino", "xb.bet1bonus.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["cdn.jsdelivr.net", "drf.honareslami.xyz", "wlwnophi.313betiran.online", "00pq7d1j.1xboropartners.com", "rfhudhbz.313betsingup.casino", "xb.bet1bonus.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a ClearFake URL as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs that match the domain training.example.com or any subdomains under it.

• Scenario: A scheduled job runs a script that fetches and validates URLs from a trusted internal source, including URLs tagged as ClearFake.
  Filter/Exclusion: Exclude URLs that originate from the internal URL validation service internal-validation-service.example.com.

• Scenario: A security tool like OSSEC or CrowdStrike is configured to periodically check for known malicious URLs, including ClearFake URLs, as part of its threat intelligence integration.
  Filter/Exclusion: Exclude URLs that are part of the internal threat intelligence feed hosted at threat-intel.example.com.

• Scenario: A user is accessing a ClearFake URL as part of a phishing simulation conducted by the security team using Mimecast or Proofpoint.
  Filter/Exclusion: Exclude URLs that contain the query parameter ?sim=phishing or originate from the domain phishing-sim.example.com.

• Scenario: A DevOps pipeline includes a step that uses a ClearFake URL to test API endpoints or validate URL formatting, such as in Jenkins or GitHub Actions.
  Filter/Exclusion: Exclude URLs that are part of the internal testing infrastructure hosted at dev-test.example.com or match the pattern test-*.example.com.