URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage ClearFake-malicious URLs to deliver phishing payloads or command-and-control traffic that may evade standard signature-based defenses. Proactively hunting for these specific indicators within Azure Sentinel is critical because it enables the SOC team to identify early-stage compromise attempts and validate endpoint exposure before widespread infection occurs.

IOC Summary

Threat: ClearFake Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["uamhqvjx.abresanishahri.store", "esjvtzn6.aloo.bet", "91vkuxv1.enf90.net", "lwflkiar.betsoor.live", "69x4o4j5.bet808.casino", "xwnfpj7t.betrein.pro", "7ipg23zj.bet808.poker", "zthayuyp.1x303.casino", "8pxyyjso.doobix.pro", "phcbmap.vip1xbet.net", "i0gxyl9q.betaffiliate.marketing", "jpopdwg.vip1xbet.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["uamhqvjx.abresanishahri.store", "esjvtzn6.aloo.bet", "91vkuxv1.enf90.net", "lwflkiar.betsoor.live", "69x4o4j5.bet808.casino", "xwnfpj7t.betrein.pro", "7ipg23zj.bet808.poker", "zthayuyp.1x303.casino", "8pxyyjso.doobix.pro", "phcbmap.vip1xbet.net", "i0gxyl9q.betaffiliate.marketing", "jpopdwg.vip1xbet.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, including targeted filters and exclusions:

• Automated Software Update Scans by Antivirus Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently query URLhaus feeds to validate the integrity of their own update servers. When an agent checks a known repository link that has been recently flagged as “ClearFake” due to a transient certificate issue or a shared IP reputation score, it triggers the alert despite being a legitimate health check.
  • Suggested Filter: Exclude traffic originating from specific service accounts (e.g., svc-antivirus-updater) and destination ports associated with update protocols (TCP 443) where the User-Agent string contains “CrowdStrike” or “Microsoft Defender”.

• Scheduled Backup Repository Verification

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs to verify connectivity and integrity of cloud storage endpoints (e.g., AWS S3 buckets or Azure Blob Storage). If the backup software probes a URL that hosts a “ClearFake” certificate chain or is hosted on an IP range recently tagged by URLhaus, the detection logic flags this routine verification as malicious.
  • Suggested Filter: Create an exclusion for traffic generated during specific maintenance windows (e.g., 02:00–04:00 UTC) from backup server subnets to known cloud storage CIDR blocks, specifically filtering out HTTP GET requests with status code 200 or 301.

• IT Admin Manual Remediation and Patch Testing

  • Scenario: System administrators often manually access vendor support portals (e.g., Microsoft Update Catalog, Cisco Smart Software Manager) to download patches or verify license keys. If an admin navig