URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage ClearFake-tagged malicious URLs to deliver targeted payloads or conduct phishing campaigns against user endpoints. Proactively hunting for these specific indicators within Azure Sentinel is critical to rapidly identify and isolate compromised assets before they can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: ClearFake Total URLs: 13 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["g5sy0m2g.calirayalake.com", "ht326ul6.hazaratbet.bet", "lqcah.cheaperthan-dirt.com", "txwd.borrender.com", "gwcs.bolesfarms.com", "bzeg.bikertlane.com", "4yl6u62i.pdfbama.com", "otcgf.christorem.com", "m4jpiubh.royaldoorsspringdale.com", "znnop.frisbeeburgerllc.com", "zuibs.jetbet.download", "ystr.bittersweetkennel.com", "dlvk.nextbahis.one"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["g5sy0m2g.calirayalake.com", "ht326ul6.hazaratbet.bet", "lqcah.cheaperthan-dirt.com", "txwd.borrender.com", "gwcs.bolesfarms.com", "bzeg.bikertlane.com", "4yl6u62i.pdfbama.com", "otcgf.christorem.com", "m4jpiubh.royaldoorsspringdale.com", "znnop.frisbeeburgerllc.com", "zuibs.jetbet.download", "ystr.bittersweetkennel.com", "dlvk.nextbahis.one"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, tailored for an enterprise environment:

• Endpoint Management Patching Cycles

  • Scenario: During nightly maintenance windows, the Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons agents initiate background updates. These tools often pull installer packages from vendor repositories that host dynamic content delivery networks (CDNs). If a specific CDN node used by the software vendor has recently been flagged by URLhaus as hosting ClearFake variants, legitimate patch downloads will trigger an alert on every workstation.
  • Suggested Filter: Exclude traffic originating from known internal management servers or specific vendor IP ranges (e.g., *.ccm.microsoft.com, *.ivanti.net) where the destination port is 443 and the user agent matches the enterprise patching tool signature.

• Third-Party SaaS Integration Webhooks

  • Scenario: The organization utilizes ServiceNow or Salesforce for IT service management, which frequently sends automated webhooks to external partners (e.g., a cloud backup provider like Veeam or a compliance scanner like Qualys). These integrations often query specific API endpoints that may share IP infrastructure with known ClearFake campaigns. A scheduled job running every 15 minutes to sync asset data could generate high-volume alerts if the partner’s URL is on the malicious list but represents a trusted business relationship.
  • Suggested Filter: Create an exclusion for URLs containing specific path patterns associated with trusted SaaS integrations (e.g., api.partner.com/v2/sync) and restrict the rule to only flag traffic where the HTTP method is not GET or where the response code is not 200 OK.

• Digital Rights Management (DRM) License Validation

  ---