URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage ClearFake-malicious URLs to deliver targeted phishing payloads or command-and-control communications that evade standard signature-based defenses. Proactively hunting for these specific indicators within Azure Sentinel is critical because early detection of ClearFake activity allows the SOC team to isolate compromised endpoints and block malicious traffic before lateral movement occurs across the cloud environment.

IOC Summary

Threat: ClearFake Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["acthwqwn.behtarin-site-shartbandi.com", "mjbpgp3k.jadoou.cfd", "omwf.jadoou.art", "elng.jadoou.baby", "rgklgdmw.jadoobet.click", "fibvhxte.bekabet.casino", "tetz.site-shartbandi-khareji.com", "owhzzucu.jadoou.cyou", "zbplgmhe.bet90forward.win", "xmgonqda.jadoobet.xyz", "9h5e0vbd.jadoou.club", "tgjg.jadoou.autos"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["acthwqwn.behtarin-site-shartbandi.com", "mjbpgp3k.jadoou.cfd", "omwf.jadoou.art", "elng.jadoou.baby", "rgklgdmw.jadoobet.click", "fibvhxte.bekabet.casino", "tetz.site-shartbandi-khareji.com", "owhzzucu.jadoou.cyou", "zbplgmhe.bet90forward.win", "xmgonqda.jadoobet.xyz", "9h5e0vbd.jadoou.club", "tgjg.jadoou.autos"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Update Checks by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) periodically query the ClearFake threat intelligence feed to cross-reference their local signature databases. These background processes generate high-volume GET requests to specific ClearFake URLs, which may be flagged as “malicious” by the rule if the URL’s reputation score is borderline or if the request pattern mimics a browser session rather than an API call.
  • Filter/Exclusion: Exclude traffic originating from known Endpoint Protection service accounts (e.g., svc-crowdstrike-updater, msdefender-agent) and restrict the rule to trigger only on interactive user sessions (User-Agent containing “Chrome”, “Edge”, or “Firefox”) rather than system-level HTTP clients.

• Scheduled Vulnerability Scans by Internal Security Tools

  • Scenario: Weekly vulnerability assessments performed by tools like Tenable Nessus, Qualys, or Rapid7 InsightVM often include a module that probes external threat intelligence feeds to validate scanner signatures. During these scheduled jobs (e.g., running every Sunday at 02:00 UTC), the scanner’s proxy service hits ClearFake URLs to verify certificate validity and content freshness, triggering alerts due to the “malicious” tag despite being an authorized administrative task.
  • Filter/Exclusion: Create a time-based exclusion for the rule during known maintenance windows (e.g., 01:00–05:00 UTC) or whitelist the specific IP addresses of internal vulnerability scanners and their associated proxy gateways.

• **Third-Party