URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage ClearFake-malicious URLs to execute phishing campaigns or deliver initial payloads into the enterprise network. The SOC team should proactively investigate these specific indicators within Azure Sentinel to identify early-stage compromise vectors and prevent lateral movement before broader infection occurs.

IOC Summary

Threat: ClearFake Total URLs: 6 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["cdn.jsdelivr.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["cdn.jsdelivr.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule in an enterprise environment:

• Automated Software Update Scanners

  • Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs scheduled background scans to check for the latest definition updates. These scanners frequently query the URLhaus API directly to validate the reputation of update servers, triggering hits on URLs associated with the “ClearFake” campaign even though they are benign infrastructure components.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe or CrowdStrike Falcon Sensor) and restrict the alert to only trigger if the destination IP is not within the organization’s known trusted update server CIDR ranges.

• IT Asset Management & Patching Workflows

  • Scenario: The IT operations team utilizes a patch management tool like Ivanti Neurons for PAM or ManageEngine Endpoint Central. During the nightly maintenance window, these tools generate reports and fetch metadata from external vendor portals to verify software integrity. These legitimate administrative queries often hit URLs flagged by ClearFake as part of their standard verification handshake.
  • Filter/Exclusion: Implement an exclusion based on the User Account (e.g., svc-patch-admin or IT-Service-Account) and the Time Window, ensuring alerts are suppressed for these specific service accounts during scheduled maintenance hours (e.g., 02:00 – 05:00 UTC).

• Security Information & Event Management (SIEM) Enrichment Jobs

  • Scenario: The central SIEM platform, such as Splunk Enterprise Security or IBM QRadar, runs a scheduled data enrichment