URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the distribution of malicious URLs associated with the ClickFix campaign, which often targets users through deceptive web links to compromise endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage phishing or drive-by download attacks that could lead to credential theft and lateral movement within the network.

IOC Summary

Threat: ClickFix Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["casinodas.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["casinodas.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the URLhaus: ClickFix Malicious URLs detection rule:

• Security Tool Health Checks & Telemetry

  • Scenario: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically send telemetry data to their cloud management consoles. These agents often query the clickfix.com domain to verify network connectivity or check for configuration updates, which can be flagged as a “ClickFix” interaction by the URLhaus feed even though it is benign internal traffic.
  • Filter/Exclusion: Create an exclusion rule that filters out traffic originating from known EDR service accounts (e.g., svc-falcon-agent, MDE-Service) or specific destination IP ranges belonging to the vendor’s cloud infrastructure, ensuring only user-initiated browser sessions trigger the alert.

• Automated Patch Management & Software Updates

  • Scenario: Enterprise patch management tools like Ivanti Neurons for PAM or WSUS (Windows Server Update Services) often utilize ClickFix URLs to download update manifests or verify license keys during scheduled nightly maintenance windows. These background jobs execute silently without user interaction, leading the detection logic to misinterpret these automated API calls as potential malicious URL clicks by end-users.
  • Filter/Exclusion: Implement a time-based exclusion for the rule during known maintenance windows (e.g., 02:00–04:00 local time) or exclude traffic where the User-Agent string contains keywords like “Ivanti-Update” or “WSUSClient”.

• Third-Party Cloud Identity & SSO Integrations

  • Scenario: During Single Sign-On (SSO) flows using Okta or Azure Active Directory, the authentication service may redirect users through a ClickFix verification