URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are part of a ClearFake campaign, which uses deceptive URLs to trick users into downloading malware. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential phishing or malware distribution attempts before they cause harm.

IOC Summary

Threat: ClearFake Total URLs: 10 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["vintagevinylrestoration.christmas", "logicbufferskills.christmas", "chroniclearchivekeeper.christmas", "pixelart-canvas.christmas", "chickencutlet-hacks.christmas", "trading-academyexpert.christmas", "formkey.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["vintagevinylrestoration.christmas", "logicbufferskills.christmas", "chroniclearchivekeeper.christmas", "pixelart-canvas.christmas", "chickencutlet-hacks.christmas", "trading-academyexpert.christmas", "formkey.asia"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a ClearFake URL as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs that match the domain training.example.com or any subdomains under it.

• Scenario: A scheduled job runs a script that downloads a legitimate update from a ClearFake-hosted repository.
  Filter/Exclusion: Exclude URLs containing the path /updates/ or any file names with .zip or .tar.gz extensions.

• Scenario: A user is accessing a phishing simulation URL that is flagged as ClearFake by the URLhaus feed.
  Filter/Exclusion: Exclude URLs that include the query parameter ?sim=phishing or originate from the domain phishing-sim.example.com.

• Scenario: A DevOps pipeline is using a CI/CD tool like Jenkins to fetch a dependency from a ClearFake-hosted artifact repository.
  Filter/Exclusion: Exclude URLs that match the pattern https://artifactory.example.com/repo/ or contain the string ci-artifact.

• Scenario: A security team is using a tool like Splunk or ELK to query a ClearFake URL as part of a threat intelligence investigation.
  Filter/Exclusion: Exclude URLs that contain the query parameter ?query=threatintel or are accessed from the IP range 192.168.0.0/16.