URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver payloads, leveraging compromised or deceptive links to compromise endpoints. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise early in the attack lifecycle.

IOC Summary

Threat: ClearFake Total URLs: 13 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["sopranos-familytree.christmas", "hoycbijv.holiday-matrix.christmas", "mkszunli.flopstin-gymcargo.cyou", "snow-harbor.christmas", "winter-pulse.christmas", "ilhvyrij.ipv4has-lampnew.cyou", "mvltyody.frost-engine.christmas", "mfwhezll.gift-lattice.christmas", "mfbrkbuv.betnoise-unionour.cyou", "gift-lattice.christmas", "xenomorphhiveintel.christmas", "ftjilgqw.winter-pulse.christmas", "ihtfqktk.holiday-matrix.christmas"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["sopranos-familytree.christmas", "hoycbijv.holiday-matrix.christmas", "mkszunli.flopstin-gymcargo.cyou", "snow-harbor.christmas", "winter-pulse.christmas", "ilhvyrij.ipv4has-lampnew.cyou", "mvltyody.frost-engine.christmas", "mfwhezll.gift-lattice.christmas", "mfbrkbuv.betnoise-unionour.cyou", "gift-lattice.christmas", "xenomorphhiveintel.christmas", "ftjilgqw.winter-pulse.christmas", "ihtfqktk.holiday-matrix.christmas"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate URL shortening service usage
  Description: Employees use URL shortening services like Bitly or TinyURL for internal documentation or sharing links.
  Filter/Exclusion: Exclude URLs containing known shortening domains (e.g., bit.ly, tinyurl.com, is.gd) or use a regex to identify shortening services.

• Scenario: Scheduled system updates via internal repository
  Description: Automated systems pull updates from an internal repository using URLs that match the pattern of malicious URLs.
  Filter/Exclusion: Exclude URLs that match internal update servers (e.g., internal-repo.example.com, update.example.com) or use a custom list of trusted internal domains.

• Scenario: Admin task for malware analysis
  Description: Security analysts manually test malware samples using sandboxed environments, which may include URLs pointing to internal analysis tools.
  Filter/Exclusion: Exclude URLs that match internal sandboxing tools (e.g., sandbox.example.com, malware-analysis.example.com) or use a whitelist of analyst activity IPs.

• Scenario: Legitimate phishing simulation campaigns
  Description: HR or IT departments run phishing simulations using URLs that mimic real company domains.
  Filter/Exclusion: Exclude URLs that match internal phishing simulation domains (e.g., phish-sim.example.com, test-phishing.example.com) or use a list of known simulation domains.

• Scenario: Automated backup job to cloud storage
  Description: Backup processes use temporary URLs to store data in cloud services like AWS S3 or Azure Blob Storage.
  Filter/Exclusion: Exclude URLs that match known cloud storage endpoints (e.g., s3.amazonaws.com, blob.core.windows.net) or use a regex to identify cloud storage service patterns.