URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage ClearFake-tagged malicious URLs to deliver phishing payloads or command-and-control traffic that may bypass standard allow-lists due to their recent registration or reputation status. Proactively hunting for these specific indicators in Azure Sentinel is critical because the high severity of ClearFake threats suggests a sophisticated campaign capable of evading initial perimeter defenses, requiring immediate investigation to prevent lateral movement and data exfiltration.

IOC Summary

Threat: ClearFake Total URLs: 15 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["pygnidup.gem90bet.com", "bgtnaqoc.fileboroo.com", "lhozmsokb.nextbahis.coupons", "dsdvsvqgy.jetbet.download", "dlylkjaji.jetboro.fun", "3x6v81kc.varzeshlife.ir", "itwynsuh.enfejartime.com", "aefauhqwk.irani-music.com", "vzsagfrw.derbi.football", "wtkxprzu.funxbet.casino", "dvc734k1.hazaratbet.game", "hzdmfcatc.sky7bet.casino", "eogwp3fe.site-shartbandi-pasor.online", "arvujwijm.irani-music.com", "iodz0i3f.behtarin-site-shartbandi-football.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pygnidup.gem90bet.com", "bgtnaqoc.fileboroo.com", "lhozmsokb.nextbahis.coupons", "dsdvsvqgy.jetbet.download", "dlylkjaji.jetboro.fun", "3x6v81kc.varzeshlife.ir", "itwynsuh.enfejartime.com", "aefauhqwk.irani-music.com", "vzsagfrw.derbi.football", "wtkxprzu.funxbet.casino", "dvc734k1.hazaratbet.game", "hzdmfcatc.sky7bet.casino", "eogwp3fe.site-shartbandi-pasor.online", "arvujwijm.irani-music.com", "iodz0i3f.behtarin-site-shartbandi-football.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, tailored for a legitimate enterprise environment:

• Endpoint Security Agent Telemetry Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) automatically queries the URLhaus API to fetch real-time threat intelligence feeds. These agents frequently hit specific “ClearFake” tagged URLs during their background health checks and definition updates, even though the traffic is initiated by a trusted security service rather than user browsing activity.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., csagent.exe, S1Service.exe, or MsMpEng.exe) combined with the User Agent string containing “CrowdStrike” or “SentinelOne”. Alternatively, whitelist the specific IP addresses of the internal security management servers that initiate these API calls.

• Scheduled Third-Party Vulnerability Scans

  • Scenario: A scheduled weekly vulnerability assessment job running via tools like Tenable Nessus, Qualys, or Rapid7 InsightVM scans external resources to verify certificate validity and content integrity. During the scan, these tools probe known “ClearFake” URLs listed in the URLhaus database as part of their baseline risk assessment, triggering alerts despite the traffic being generated by a trusted service account (e.g., svc_vuln_scan).
  • Filter/Exclusion: Exclude traffic originating from the Service Account used for scanning or restrict the rule to exclude specific Source IP Subnets dedicated to security appliances. Additionally, filter out requests where the HTTP method is strictly HEAD or GET with a User-Agent containing “Tenable” or “Qualys”.

• **IT Admin Manual Threat Intelligence Verification