URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver malware or exfiltrate data, leveraging known malicious domains to compromise endpoints. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential breaches early, especially since these URLs are actively used in targeted attacks.

IOC Summary

Threat: ClearFake Total URLs: 13 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["rykwhjt.winsportiran.com", "cqvdiki.xenicalby6.com", "inmjycz.olabahiskayit.com", "pmhaqci.x50wheel.bet", "mpozwop.winxbet.co", "xzelng.jamjahani.cash", "hjwaxur.kvbel.com", "5dwz6wj9.yekbetiran.com", "ebwgtb.vezaratshart.com", "gwu729hw.parspoker.casino", "yynpur.perfectgame.casino", "anpysts.yasbetapp.com", "tviyhdt.winstone.casino"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["rykwhjt.winsportiran.com", "cqvdiki.xenicalby6.com", "inmjycz.olabahiskayit.com", "pmhaqci.x50wheel.bet", "mpozwop.winxbet.co", "xzelng.jamjahani.cash", "hjwaxur.kvbel.com", "5dwz6wj9.yekbetiran.com", "ebwgtb.vezaratshart.com", "gwu729hw.parspoker.casino", "yynpur.perfectgame.casino", "anpysts.yasbetapp.com", "tviyhdt.winstone.casino"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator manually enters a ClearFake URL into a ticketing system (e.g., Jira) to test a phishing simulation.
  Filter/Exclusion: Exclude URLs that match known phishing simulation domains (e.g., phishsim.example.com) or filter by source IP of internal admin workstations.

• Scenario: A scheduled job runs a script that downloads a ClearFake URL to verify its legitimacy (e.g., a security tool like OSSEC or CrowdStrike Falcon performing a test).
  Filter/Exclusion: Exclude URLs that are part of known test environments or use a specific user account (e.g., [email protected]) for automated tasks.

• Scenario: A user clicks on a ClearFake URL shared via a legitimate internal communication tool (e.g., Microsoft Teams or Slack) as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs that originate from internal communication platforms or are tagged with a training identifier (e.g., training-link in the URL path).

• Scenario: A system update or patching tool (e.g., Ansible, Chef, or Puppet) temporarily uses a ClearFake URL as part of a test or staging environment.
  Filter/Exclusion: Exclude URLs that are part of CI/CD pipelines or match known staging environments (e.g., staging.example.com).

• Scenario: A security tool (e.g., CrowdStrike, Microsoft Defender, or FireEye) uses a ClearFake URL as part of its sandboxing or threat intelligence validation process.
  Filter/Exclusion: Exclude URLs that are associated with known security tooling or are part of a sandboxed environment (e.g., sandboxed-traffic.example.com).