URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver malware or exfiltrate data, leveraging compromised or impersonated domains to evade traditional detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential command and control channels or data exfiltration attempts early.

IOC Summary

Threat: ClearFake Total URLs: 15 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["wildfloraprocessingsystem.garden", "botanicalresourceplatform.garden", "flow-hub-green-house-work.garden", "got-flexl-distrib-engine.garden", "wild-flora-processing-go-system.garden", "forgotten-civilization-myth.garden", "irrigation-control-network.garden", "greenhouseworkflowhub.garden", "shells-garden-framework.garden", "petal-distribution-engine.garden", "bots-unical-resource-platform.garden", "distributed-garden-framework.garden"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["wildfloraprocessingsystem.garden", "botanicalresourceplatform.garden", "flow-hub-green-house-work.garden", "got-flexl-distrib-engine.garden", "wild-flora-processing-go-system.garden", "forgotten-civilization-myth.garden", "irrigation-control-network.garden", "greenhouseworkflowhub.garden", "shells-garden-framework.garden", "petal-distribution-engine.garden", "bots-unical-resource-platform.garden", "distributed-garden-framework.garden"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator manually enters a ClearFake URL into a ticketing system (e.g., ServiceNow) to test a phishing simulation.
  Filter/Exclusion: Exclude URLs originating from known ticketing systems or internal testing environments (e.g., source == "ServiceNow" or url.contains("phishing-sim")).

• Scenario: A scheduled job runs a script that downloads a ClearFake URL as part of a malware analysis process (e.g., using Cuckoo Sandbox or VirusTotal API).
  Filter/Exclusion: Exclude URLs associated with malware analysis tools (e.g., url.contains("cuckoo") or url.contains("virustotal")).

• Scenario: An IT department uses a legitimate tool like Microsoft Defender ATP to generate a ClearFake URL for internal testing or reporting purposes.
  Filter/Exclusion: Exclude URLs from known security tools (e.g., url.contains("Microsoft Defender ATP") or source == "Microsoft Defender").

• Scenario: A user clicks on a ClearFake URL shared via a company-wide internal communication platform (e.g., Microsoft Teams or Slack) as part of a security awareness training exercise.
  Filter/Exclusion: Exclude URLs from internal communication platforms (e.g., source == "Microsoft Teams" or source == "Slack") or URLs containing training-related keywords (e.g., url.contains("security-training")).

• Scenario: A backup or sync job (e.g., using rsync or Veeam) temporarily generates a ClearFake URL during file transfer or metadata processing.
  Filter/Exclusion: Exclude URLs related to backup/sync tools (e.g., url.contains("rsync") or url.contains("Veeam")) or those with specific file transfer patterns (e.g., url.contains("backup")).