URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver payloads, leveraging compromised or deceptive links to compromise endpoints. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise before lateral movement or data exfiltration occurs.

IOC Summary

Threat: ClearFake Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["vkoqp.accredit.hu", "dxblg.workoutwithdorci.com", "cadcr.zaszlorudbolt.hu", "xjmes.yanis.hu", "ekyso.addmagad.com", "djwof.ady26.hu", "qxyvx.yanisrea.hu", "kbjqa.wpsmart.app", "gplca9pf.script-bridge.digital", "3822lbt1.stack-sphere.digital", "cwzbp.wlwyb.com", "mzwum.wilhelmglobal.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["vkoqp.accredit.hu", "dxblg.workoutwithdorci.com", "cadcr.zaszlorudbolt.hu", "xjmes.yanis.hu", "ekyso.addmagad.com", "djwof.ady26.hu", "qxyvx.yanisrea.hu", "kbjqa.wpsmart.app", "gplca9pf.script-bridge.digital", "3822lbt1.stack-sphere.digital", "cwzbp.wlwyb.com", "mzwum.wilhelmglobal.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator manually enters a ClearFake URL into a ticketing system (e.g., Jira) to test a phishing simulation.
  Filter/Exclusion: Exclude URLs that match the domain of the organization’s internal phishing testing platform (e.g., phishing-test.example.com).

• Scenario: A scheduled job runs a script that downloads a ClearFake URL as part of a malware analysis process (e.g., using Cuckoo Sandbox or VirusTotal API).
  Filter/Exclusion: Exclude URLs that contain the substring malwareanalysis or match the IP address of the internal analysis server.

• Scenario: A user clicks on a ClearFake URL shared via a legitimate internal communication tool (e.g., Microsoft Teams or Slack) during a security awareness training session.
  Filter/Exclusion: Exclude URLs that originate from the internal security training domain (e.g., training.example.com).

• Scenario: A DevOps pipeline deploys a CI/CD tool (e.g., Jenkins) that temporarily uses a ClearFake URL for a test artifact download.
  Filter/Exclusion: Exclude URLs that match the artifact download domain used by the CI/CD system (e.g., artifacts.ci.example.com).

• Scenario: An IT helpdesk employee uses a ClearFake URL to generate a test report for a security tool (e.g., Splunk or SIEM) during a system test.
  Filter/Exclusion: Exclude URLs that contain the string test-report or match the internal test environment domain (e.g., test-siem.example.com).