URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are part of a ClearFake campaign, which uses deceptive URLs to trick users into downloading malicious payloads. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential phishing or credential theft attacks before they lead to data exfiltration or system compromise.

IOC Summary

Threat: ClearFake Total URLs: 15 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["byte-vault.christmas", "signal-processing-core.christmas", "microservice-hub.christmas", "stackbridge.christmas", "cloud-sync-engine.christmas", "network-flow-system.christmas", "proxy-hub.christmas", "telemetry-control-hub.christmas", "container-mesh.christmas", "packet-distribution-core.christmas"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["byte-vault.christmas", "signal-processing-core.christmas", "microservice-hub.christmas", "stackbridge.christmas", "cloud-sync-engine.christmas", "network-flow-system.christmas", "proxy-hub.christmas", "telemetry-control-hub.christmas", "container-mesh.christmas", "packet-distribution-core.christmas"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate URLhaus feed integration
  Description: The SOC is using the URLhaus feed as part of its threat intelligence integration, and the feed includes URLs tagged as ClearFake due to their association with known malicious domains.
  Filter/Exclusion: Exclude URLs that are part of the URLhaus feed by checking the source or using a field like source or feed_id to filter out known benign entries.

• Scenario: Scheduled system update job
  Description: A scheduled job runs a system update that downloads a ClearFake URL as part of a legitimate patching process.
  Filter/Exclusion: Exclude URLs that match known update servers (e.g., updates.microsoft.com, download.oracle.com) or use a process.name filter to exclude known update tools like wuauclt.exe or updatenow.exe.

• Scenario: Admin task for endpoint configuration
  Description: An admin is manually configuring endpoints and uses a ClearFake URL to download a configuration file or script.
  Filter/Exclusion: Exclude URLs that are associated with admin tools or configuration management systems (e.g., puppet, ansible, chef) by checking the process.name or user field for admin accounts.

• Scenario: Legitimate phishing simulation test
  Description: The security team is running a phishing simulation and uses a ClearFake URL as part of the test to gauge employee response.
  Filter/Exclusion: Exclude URLs that are part of a phishing simulation tool (e.g., phishsim.com, testphish.net) or use a category field to filter out test URLs.

• Scenario: Malware analysis lab activity
  Description: A malware analysis lab is using a ClearFake URL to download a sample for analysis, which is part of their routine testing.
  *