URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The detection identifies potential ClearFake malicious URLs that adversaries may use to deliver malware or phishing payloads. SOC teams should proactively hunt for these URLs in Azure Sentinel to disrupt adversary campaigns and protect user endpoints before significant damage occurs.

IOC Summary

Threat: ClearFake Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["gdenwcw.rabonaabet.com", "demfmb.restaurantguideaarhus.com", "jbwjdp.rial.bet", "e3giv37r.pokerpars.poker", "gwjjko.onlineshart.com", "salppir.red90.casino", "xwwitjs.rayonbet.com", "gyayod.pishbinisite.com", "w18yfaze.yekbetiran.com", "zlbcjre.wrfc8.com", "whyldsf.rc395.com", "gfmuomz.pinbahiis.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["gdenwcw.rabonaabet.com", "demfmb.restaurantguideaarhus.com", "jbwjdp.rial.bet", "e3giv37r.pokerpars.poker", "gwjjko.onlineshart.com", "salppir.red90.casino", "xwwitjs.rayonbet.com", "gyayod.pishbinisite.com", "w18yfaze.yekbetiran.com", "zlbcjre.wrfc8.com", "whyldsf.rc395.com", "gfmuomz.pinbahiis.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator manually enters a ClearFake URL into a ticketing system (e.g., ServiceNow) to test a phishing response drill.
  Filter/Exclusion: Exclude URLs that match known internal ticketing system domains or use a field like url.contains("service-now.com") or url.contains("test-phishing").

• Scenario: A scheduled job runs a script that downloads a ClearFake URL as part of a malware analysis setup (e.g., using Cuckoo Sandbox or VirusTotal API).
  Filter/Exclusion: Exclude URLs that are part of known sandboxing or analysis platforms (e.g., url.contains("cuckoo"), url.contains("virustotal"), or url.contains("sandbox")).

• Scenario: A developer uses a ClearFake URL in a test environment to simulate a phishing attack for security training purposes (e.g., using Metasploit or a custom training tool).
  Filter/Exclusion: Exclude URLs that include specific test environment domains (e.g., url.contains("training.example.com"), url.contains("phishing-test"), or url.contains("metasploit")).

• Scenario: A backup or sync job (e.g., using rsync or Rclone) temporarily stores a ClearFake URL in a log file or configuration as part of a script execution.
  Filter/Exclusion: Exclude URLs that appear in backup or sync job logs (e.g., url.contains("rsync"), url.contains("rclone"), or url.contains("backup")).

• Scenario: A user clicks on a ClearFake URL in an internal email that was sent as part of a legitimate security awareness campaign (e.g., using Microsoft 365’s phishing simulation tool).
  Filter/Exclusion: Exclude URLs that match internal security awareness domains (e.g., `url.contains