URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This rule detects user-initiated execution of malicious scripts or payloads triggered by ClickFix social engineering attacks, where victims are lured into running code via manipulated URLs. Proactively hunting for these specific URLhaus entries allows the SOC to identify compromised endpoints early, preventing the initial foothold that adversaries use to deploy further malware or establish persistence within the Azure environment.

IOC Summary

Threat: ClickFix Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["imap.usslimsounds.com", "45.39.84.142", "cdn.jsdelivr.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["imap.usslimsounds.com", "45.39.84.142", "cdn.jsdelivr.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security team or application owner is actively testing a new web application’s error handling or redirect logic using a staging environment that mirrors production, where the ClickFix URL is intentionally embedded in a test case or debug parameter to verify how the frontend parses and displays external links before deployment.

  • Filter/Exclusion: Exclude traffic where the User-Agent contains staging-test or qa-verification, or where the source IP belongs to the designated QA subnet (e.g., 10.20.0.0/24), and the request path includes /debug or /test-redirect.

• Scenario: An IT administrator is performing a manual vulnerability scan or penetration test on a legacy internal portal using a tool like Burp Suite or OWASP ZAP, which may replay or inject known malicious URL patterns (including ClickFix strings) to test the WAF or content filter’s detection capabilities in a controlled lab environment.

  • Filter/Exclusion: Exclude events where the source host is identified as a scanning appliance (e.g., hostname pentest-box-01) or where the User-Agent contains BurpSuite, ZAP, or Nessus, and the destination port is 80/443 on the internal lab VLAN.

• Scenario: A developer is running local unit tests for a JavaScript-based URL sanitizer library using a test suite that includes known malicious URL samples (including ClickFix variants) to ensure the regex or parser correctly identifies and strips dangerous strings before the code is committed to the repository.

  • Filter/Exclusion: Exclude traffic originating from developer workstations (identified via AD group Dev-Team) where the request is made to a local loopback address (127.0.0.1) or a private IP range (192.168.x.x), and the User-Agent