URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving ClickFix malware distribution through specific malicious URLs known to deliver ransomware or information stealers via browser-based attacks. Proactive hunting in Azure Sentinel is critical because these URLs often serve as initial entry points for supply chain compromises that can rapidly escalate into widespread endpoint infections if not intercepted early.

IOC Summary

Threat: ClickFix Total URLs: 3 Active URLs: 2

URL	Status	Threat	Date Added
`hxxps://breakneckridgefarm.com/payload.dat`	offline	malware_download	2026-07-27
`hxxps://breakneckridgefarm.com/p.dat`	online	malware_download	2026-07-27
`hxxps://babydiapersinturkey.com/s.dat`	online	malware_download	2026-07-27

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["breakneckridgefarm.com", "babydiapersinturkey.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["breakneckridgefarm.com", "babydiapersinturkey.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ClickFix Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Security Scanner Probing
- Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys Guard, or Rapid7 InsightVM) periodically execute scheduled jobs to test web application firewalls. These tools often generate high-volume traffic by probing known malicious URL databases, including ClickFix signatures, as part of their signature validation routines.
- Filter/Exclusion: Create an exclusion rule based on the source IP ranges of your security scanning appliances (e.g., SourceIP IN 10.20.30.0/24) or filter out events where the user agent string contains specific keywords like “Tenable,” “Qualys,” or “Rapid7.”
Scenario: Endpoint Protection Cloud Updates
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) perform daily cloud-based definition updates. During these update cycles, the agents query URLhaus and other threat intelligence feeds to download the latest ClickFix indicators, triggering the detection logic on the management server or agent nodes.
- Filter/Exclusion: Exclude events originating from specific service accounts used by EDR management (e.g., UserAccount = 'svc-crowdstrike' or ProcessName = 'falcon.sys') and restrict the rule to only trigger during business hours if updates are scheduled for off-hours.
Scenario: Admin Manual Threat Intelligence Review
- Context: Security analysts performing manual threat hunting often access the URLhaus dashboard directly via a browser (e.g., Chrome, Edge) or use internal ticketing systems (like **