URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are part of a ClearFake campaign designed to deceive users into visiting malicious sites, thereby enabling phishing or malware delivery. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise of user credentials and systems.

IOC Summary

Threat: ClearFake Total URLs: 9 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["bioluminescent-fungi-spore.garden", "botanicalautomationframework.garden", "petalresourceengine.garden", "wildfloramanagementplatform.garden", "carbon-fiber-monocoque.garden", "distributedgardenanalytics.garden", "interstellar-dust-nebula.garden"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["bioluminescent-fungi-spore.garden", "botanicalautomationframework.garden", "petalresourceengine.garden", "wildfloramanagementplatform.garden", "carbon-fiber-monocoque.garden", "distributedgardenanalytics.garden", "interstellar-dust-nebula.garden"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a ClearFake URL as part of a security exercise or red team simulation.
  Filter/Exclusion: Exclude URLs that match the domain test.clearfake.com or any subdomains used in internal security testing.

• Scenario: A scheduled job runs a script that fetches and validates URLs from a known safe source, such as a company’s internal knowledge base, which includes URLs tagged as ClearFake.
  Filter/Exclusion: Exclude URLs that originate from the internal domain internal-kb.example.com or any IP addresses within the company’s private network range.

• Scenario: A user clicks on a ClearFake URL that was shared via email by a legitimate internal support team to direct users to a phishing awareness page.
  Filter/Exclusion: Exclude URLs that contain the query parameter ?utm_source=security-training or are hosted on the internal training portal training.example.com.

• Scenario: A security tool like OSSEC or Splunk is configured to periodically check for known malicious URLs and reports any matches, including ClearFake URLs, as part of its routine monitoring.
  Filter/Exclusion: Exclude URLs that are part of the internal monitoring system, such as those hosted on monitoring.example.com or any URLs with the path /check-url.

• Scenario: A developer is using a tool like Burp Suite or Postman to manually test API endpoints, and one of the endpoints is flagged as a ClearFake URL during a scan.
  Filter/Exclusion: Exclude URLs that include the query parameter ?test=true or are associated with the development environment domain dev.example.com.