URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver payloads, leveraging compromised or deceptive links to compromise endpoints. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise early in the attack lifecycle.

IOC Summary

Threat: ClearFake Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["ilmlvxt.lolsurpriseball.com", "5bksyseg.betistmobil.com", "mqbjnx.jamjahani.app", "nqbecrh.one1x.bet", "l9tynneu.mybookieiran.com", "bvnvrjx.kvbel.com", "zfrfayl.one1xbet.app", "g2z2cnlz.pascal.casino", "hdkkxsm.kbshavanese.com", "et5qogz2.one1xbet.promo", "a96ampff.mrgreenbetiran.com", "avygupe.one1xbet.casino"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["ilmlvxt.lolsurpriseball.com", "5bksyseg.betistmobil.com", "mqbjnx.jamjahani.app", "nqbecrh.one1x.bet", "l9tynneu.mybookieiran.com", "bvnvrjx.kvbel.com", "zfrfayl.one1xbet.app", "g2z2cnlz.pascal.casino", "hdkkxsm.kbshavanese.com", "et5qogz2.one1xbet.promo", "a96ampff.mrgreenbetiran.com", "avygupe.one1xbet.casino"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a ClearFake URL as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs that match the domain training.example.com or any subdomains under it.
  Example Filter: url contains "training.example.com"

• Scenario: A scheduled job runs a script that downloads a ClearFake URL to verify its legitimacy as part of a security tool validation process.
  Filter/Exclusion: Exclude URLs that match the domain validation.example.com or any subdomains under it.
  Example Filter: url contains "validation.example.com"

• Scenario: A developer is using a tool like curl or wget to fetch a ClearFake URL for testing a web application’s input validation logic.
  Filter/Exclusion: Exclude URLs that match the domain dev-test.example.com or any subdomains under it.
  Example Filter: url contains "dev-test.example.com"

• Scenario: An enterprise uses a tool like PowerShell to automate the retrieval of ClearFake URLs for internal testing or integration with a sandboxing environment.
  Filter/Exclusion: Exclude URLs that match the domain sandbox.example.com or any subdomains under it.
  Example Filter: url contains "sandbox.example.com"

• Scenario: A system is configured to periodically fetch ClearFake URLs as part of a security tool’s update or configuration process.
  Filter/Exclusion: Exclude URLs that match the domain update.example.com or any subdomains under it.
  Example Filter: url contains "update.example.com"