URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors utilize ClearFake-malicious URLs to deliver payloads or conduct phishing campaigns within the organization’s network traffic. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of this high-severity threat family can prevent lateral movement and data exfiltration before automated alerts trigger.

IOC Summary

Threat: ClearFake Total URLs: 9 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["xxjbypq.takbetkade.com", "oxepqya.btyek.autos", "ms9amh2h.1xcart.vip", "gakvmew.tinybet.bio", "sevffjdu.jozveyek.com", "rxyvhv1x.1xforward.cash", "1v2w5ogt.prozhe.shopping", "cgoucbv.thevallartasrestaurants.com", "wji9u2ff.fileecell.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["xxjbypq.takbetkade.com", "oxepqya.btyek.autos", "ms9amh2h.1xcart.vip", "gakvmew.tinybet.bio", "sevffjdu.jozveyek.com", "rxyvhv1x.1xforward.cash", "1v2w5ogt.prozhe.shopping", "cgoucbv.thevallartasrestaurants.com", "wji9u2ff.fileecell.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Scenario 1: Automated Software Update Checks by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently poll the ClearFake infrastructure to validate their own signature databases or check for known malware definitions. These queries often originate from high-volume service accounts and may hit URLs flagged as “ClearFake” during initial discovery phases before full whitelisting occurs.
  • Suggested Filter/Exclusion: Exclude traffic originating from specific internal IP ranges assigned to the Security Operations Center (SOC) or Endpoint Management servers, specifically filtering for User-Agent strings containing *CrowdStrike*, *Defender-Cloud*, or *WSUS*.

• Scenario 2: Scheduled Backup and Data Integrity Verification Jobs

  • Context: Legacy backup solutions (e.g., Veeam Backup & Replication, Commvault) perform daily integrity checks that involve downloading hash manifests from external repositories. If the backup vendor utilizes ClearFake URLs for their manifest distribution or checksum validation services, these scheduled jobs will trigger alerts during their nightly execution window.
  • Suggested Filter/Exclusion: Create a time-based exclusion rule to suppress alerts between 02:00 and 05:00 local time (standard maintenance windows) for source IPs belonging to the “Backup-Infrastructure” VLAN, targeting specific destination ports commonly used by these backup agents (e.g., TCP 443, 873).

• Scenario 3: Third-Party SaaS Integration and API Health Checks

  • Context: Enterprise Resource Planning (ERP) systems like SAP or Oracle NetSuite often integrate with external threat intelligence feeds. A scheduled