URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage ClearFake-tagged malicious URLs to deliver phishing payloads or drive-by downloads that compromise user endpoints within the Azure environment. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of this known malware family allows the SOC team to isolate affected assets and block command-and-control communications before lateral movement occurs.

IOC Summary

Threat: ClearFake Total URLs: 14 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["lancer.shartboro.xyz", "j1yidzep.boombasket.bet", "zi6uvzi9.btyek.beauty", "vxg18bmc.btyek.baby", "35iozqs1.bet1bonus.com", "0oj9pa7x.1xbetlogin.co", "cess.digishart.news", "wt51peii.boomball.bet", "1ozso11s.blackjackonlineplay83.com", "cdn.jsdelivr.net", "fpqatzfu.btyek.autos", "c28vzpro.bet808.app"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["lancer.shartboro.xyz", "j1yidzep.boombasket.bet", "zi6uvzi9.btyek.beauty", "vxg18bmc.btyek.baby", "35iozqs1.bet1bonus.com", "0oj9pa7x.1xbetlogin.co", "cess.digishart.news", "wt51peii.boomball.bet", "1ozso11s.blackjackonlineplay83.com", "cdn.jsdelivr.net", "fpqatzfu.btyek.autos", "c28vzpro.bet808.app"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Automated Software Update Checks by Patch Management Tools

  • Scenario: Enterprise patch management solutions (e.g., Microsoft SCCM, Ivanti Endpoint Manager, or Jamf) frequently query vendor update servers to check for new definitions. These tools often access URLs hosted on domains that have recently been flagged by URLhaus as “ClearFake” due to shared hosting infrastructure, even though the specific endpoints accessed are legitimate update manifests.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., Hostnames containing 'SCCM-Update' or IP Ranges of Patch Servers) and filter for specific HTTP status codes (200 OK) where the User-Agent string matches known patch management tools.

• Scheduled Compliance Scans by Security Information Systems

  • Scenario: Scheduled jobs running on compliance engines like Qualys, Tenable Nessus, or Tripwire perform daily vulnerability assessments. These agents may attempt to validate SSL certificates or fetch configuration files from external partner portals that URLhaus has temporarily tagged as ClearFake due to a recent certificate renewal or IP rotation, triggering alerts despite the traffic being part of a routine compliance window.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00 - 04:00 UTC) for specific Destination URLs associated with trusted vendor domains, or exclude traffic originating from the Service Account used by these scanning agents.

• Cloud Identity and Access Management (IAM) Token Refreshes

  • Scenario: In environments using hybrid identity solutions like Okta, Azure AD, or