URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver payloads, leveraging compromised or deceptive links to compromise endpoints. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise vectors before they lead to data exfiltration or system control.

IOC Summary

Threat: ClearFake Total URLs: 11 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["zoneday-green-house-oper-center.garden", "petalprocessingplatform.garden", "botanicalworkflowcenter.garden", "irrigationautomationhub.garden", "meadowmonitoringplatform.garden", "distributedgrowthnetwork.garden", "containerizedplantnetwork.garden", "ecosystemmanagementcore.garden", "floraanalyticsengine.garden", "wildfloracontrolsystem.garden"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["zoneday-green-house-oper-center.garden", "petalprocessingplatform.garden", "botanicalworkflowcenter.garden", "irrigationautomationhub.garden", "meadowmonitoringplatform.garden", "distributedgrowthnetwork.garden", "containerizedplantnetwork.garden", "ecosystemmanagementcore.garden", "floraanalyticsengine.garden", "wildfloracontrolsystem.garden"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a security tool by inputting a known ClearFake URL into a test environment to validate detection capabilities.
  Filter/Exclusion: process.name != "security_tool_test_script" or process.args != "test_clearfake_url"

• Scenario: A scheduled job runs a script that downloads a legitimate software update from a URL tagged as ClearFake by URLhaus, but the update is signed and verified by the vendor.
  Filter/Exclusion: file.hash != "known_legitimate_update_hash" or process.name != "scheduled_update_job"

• Scenario: An IT admin is performing a system cleanup and uses a tool like PowerShell or Batch Script to remove old files, which includes a URL that was mistakenly flagged by URLhaus.
  Filter/Exclusion: process.name != "cleanup_script" or process.args != "remove_old_files"

• Scenario: A user is accessing a legitimate phishing training page hosted on a domain that was previously listed in URLhaus as ClearFake, but is now used for security awareness.
  Filter/Exclusion: process.name != "browser" or url.domain != "phishing-training.example.com"

• Scenario: A DevOps pipeline is using a CI/CD tool like Jenkins or GitHub Actions to deploy code, and one of the build steps includes a URL from a known ClearFake list for testing purposes.
  Filter/Exclusion: process.name != "jenkins" or "github_actions" or url.path != "/test-deploy-endpoint"