URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage ClearFake-signed malicious URLs to deliver payloads that may bypass standard signature-based defenses due to their trusted appearance. Proactively hunting for these specific indicators in Azure Sentinel is critical because it enables the SOC team to identify and isolate compromised endpoints before they execute sophisticated supply chain or phishing attacks that exploit the credibility of valid certificates.

IOC Summary

Threat: ClearFake Total URLs: 11 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["w9x1nvom.sizzleasianfood.com", "oxqniwv.1xpin.vip", "vlmtl3yv.jozvedownload.com", "jds4p0yc.betbacklink.com", "qxguiws.1xpin.org", "dhur9q3h.1x303.casino", "fnd9555t.ligabfa.com", "adoswjr.calvaryhospice.org", "ao046xe5.1xbeet.xyz", "evhg599x.lemongrassasiangrill.com", "frhphph.1xsomalia.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["w9x1nvom.sizzleasianfood.com", "oxqniwv.1xpin.vip", "vlmtl3yv.jozvedownload.com", "jds4p0yc.betbacklink.com", "qxguiws.1xpin.org", "dhur9q3h.1x303.casino", "fnd9555t.ligabfa.com", "adoswjr.calvaryhospice.org", "ao046xe5.1xbeet.xyz", "evhg599x.lemongrassasiangrill.com", "frhphph.1xsomalia.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint) perform daily background checks against known threat intelligence feeds. These agents may query the specific ClearFake domains to validate their local signature databases, generating traffic that matches the malicious URL pattern despite being a legitimate maintenance task.
  • Suggested Filter: Exclude network flows originating from the specific service accounts or host groups dedicated to Endpoint Management (e.g., Source_Host_Group = "EP_Agents" AND Process_Name = "CrowdStrikeService").

• Automated Vulnerability Assessment Scans

  • Scenario: Security teams run periodic vulnerability scans using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM. These scanners often probe external threat intelligence URLs to benchmark their own scanning engines against the latest ClearFake indicators, resulting in high-volume HTTP/HTTPS requests that trigger the rule.
  • Suggested Filter: Create an exclusion for traffic originating from the dedicated IP subnets of the Vulnerability Management infrastructure (e.g., Source_IP_Range = "10.20.50.0/24" AND Destination_Port = 443).

• IT Admin Manual Threat Intelligence Research

  • Scenario: Security analysts or IT administrators manually investigate emerging threats by visiting the ClearFake URL list directly in their web browsers (e.g., Google Chrome, Microsoft Edge) to verify domain reputation. This is common during incident response or weekly threat briefing sessions where admins click through the list of 11 specific URLs.

  ---