URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage ClearFake-tagged malicious URLs to deliver targeted phishing or malware payloads within the organization’s network traffic. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of this high-severity campaign enables rapid containment before attackers can establish persistence or exfiltrate sensitive data through compromised endpoints.

IOC Summary

Threat: ClearFake Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["drij.bahsegel90.com", "kysv223u.zaribbala.bet", "zpuc.bekabet.casino", "bujybzpn.site-shartbandi-takhtenard.com", "vozzijig.site-shartbandi-pasor.online"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["drij.bahsegel90.com", "kysv223u.zaribbala.bet", "zpuc.bekabet.casino", "bujybzpn.site-shartbandi-takhtenard.com", "vozzijig.site-shartbandi-pasor.online"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, tailored for an enterprise environment:

• Endpoint Antivirus Signature Updates via Cloud Repositories

  • Scenario: The enterprise uses Microsoft Defender for Endpoint or CrowdStrike Falcon, which periodically pulls signature definition updates from their cloud repositories. These update servers often host dynamic URLs that may be newly registered or hosted on shared infrastructure, leading URLhaus to flag them with the “ClearFake” tag due to rapid content changes or low reputation scores at the time of scanning.
  • Filter/Exclusion: Create a whitelist rule for specific destination IP ranges associated with the vendor’s update servers (e.g., *.update.microsoft.com or *.crowdstrike.com) and exclude traffic on standard HTTPS ports (443) originating from the internal “Patch Management” subnet.

• Scheduled HR Payroll Data Synchronization

  • Scenario: A nightly scheduled job using PowerShell scripts runs on a dedicated HR server to synchronize employee data with an external payroll provider like ADP Workforce Now or Workday. The synchronization process generates unique, parameter-heavy URLs for API handshakes. Because these URLs are dynamically generated and may contain long query strings, the URLhaus heuristic might misclassify them as “ClearFake” due to perceived complexity or lack of historical traffic patterns on specific subdomains.
  • Filter/Exclusion: Implement a time-based exclusion (e.g., 01:00–04:00 UTC) for traffic originating from the HR server’s hostname (hr-sync-01.corp.local) destined for known payroll vendor domains, specifically excluding URLs containing standard API path prefixes like /api/v1/sync or /oauth/token.

• IT Helpdesk Ticketing System Integration *