URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised endpoints attempt to communicate with known ClearFake phishing or malware distribution sites identified by URLhaus. Proactively hunting these specific malicious URLs in Azure Sentinel is critical because it enables early detection of initial infection vectors before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Threat: ClearFake Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["htfll3q5.1x303.casino", "dows.sabad724.bio", "8zdusrwn.xbetone.com", "o2rfpbnw.vip1xbet.net", "cdn.jsdelivr.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["htfll3q5.1x303.casino", "dows.sabad724.bio", "8zdusrwn.xbetone.com", "o2rfpbnw.vip1xbet.net", "cdn.jsdelivr.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, tailored for an enterprise environment where legitimate activities trigger alerts due to known benign traffic patterns matching the “ClearFake” signature.

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently initiate background scans to check for definition updates. These agents often query public threat intelligence feeds that host the “ClearFake” signature database, generating HTTP/HTTPS requests to URLs flagged as malicious by URLhaus but actually serving legitimate update metadata.
  • Suggested Filter: Exclude traffic originating from the specific service accounts or process names associated with the EDR agent (e.g., C:\Program Files\CrowdStrike\fs.exe or Microsoft Defender Antivirus) destined for known update domains, provided the HTTP status code is 200 OK.

• Scheduled Group Policy Object (GPO) Health Checks

  • Scenario: During scheduled maintenance windows, Domain Controllers running Windows Server 2019/2022 execute Group Policy health checks. These tasks involve downloading policy templates and compliance reports from internal or external repositories that utilize the ClearFake URL structure for content delivery networks (CDNs). The detection logic may misinterpret these high-volume, periodic bulk downloads as suspicious activity.
  • Suggested Filter: Create an exclusion rule based on the source IP ranges of Domain Controllers (DC-IP-RANGE) and filter by the specific scheduled task name GroupPolicyHealthCheck running during off-hours (e.g., 02:00–04:00 local time).

• Third-Party SaaS Integration Webhooks

  • Scenario: Enterprise Service Management tools like ServiceNow,