URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving ClickFix malware distribution through three specific malicious URLs known to deliver ransomware or infostealer payloads via browser-based attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malware establishes persistence on user systems.

IOC Summary

Threat: ClickFix Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["shell-node-7uxe.vercel.app"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["shell-node-7uxe.vercel.app"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: ClickFix Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Tool Health Checks

  • Context: Internal security appliances (e.g., CrowdStrike Falcon, SentinelOne, or Tenable Nessus) perform daily health checks by probing external endpoints. These tools often query known URL intelligence feeds that may include ClickFix-tagged domains as part of their baseline validation logic, triggering the rule despite no user interaction.
  • Filter/Exclusion: Exclude traffic originating from specific security appliance IP ranges or Service Accounts (e.g., CN=SentinelOne-HealthCheck, CrowdStrike-Falcon). Add a filter to ignore alerts where the UserAgent contains keywords like “Tenable,” “Falcon,” or “Nessus.”

• Scenario: Scheduled Macro Execution in Office 365

  • Context: Enterprise-wide scheduled jobs run via Microsoft Power Automate or SharePoint Designer to update internal dashboards. These workflows often fetch data from external content delivery networks (CDNs) or partner portals that host ClickFix-tagged resources. When the service account executes these macros, it generates high-volume URL requests flagged as malicious by the rule.
  • Filter/Exclusion: Create an exclusion for traffic initiated by specific Service Principals used in Power Automate flows (e.g., AppID-xxxxx). Additionally, filter out URLs that resolve to known internal CDN subdomains or approved partner domains listed in a whitelisted allow-list CSV.

• Scenario: Software Update Mechanisms for Enterprise Applications

  • Context: Legacy enterprise applications such as SAP SuccessFactors, Workday, or Adobe Document Cloud utilize background services to check for patches and feature updates. These services frequently connect to