URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using ClearFake malicious URLs to deliver payloads, leveraging compromised or deceptive links to compromise endpoints. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise of internal systems before lateral movement or data exfiltration occurs.

IOC Summary

Threat: ClearFake Total URLs: 17 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["floraresourcecenter.garden", "ecosystemworkflow.garden", "containerized-growth-platform.garden", "irrigation-control-framework.garden", "federatedplantmesh.garden", "bloom-distribution-engine.garden", "meadow-observability-core.garden"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["floraresourcecenter.garden", "ecosystemworkflow.garden", "containerized-growth-platform.garden", "irrigation-control-framework.garden", "federatedplantmesh.garden", "bloom-distribution-engine.garden", "meadow-observability-core.garden"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate scheduled job downloading updates from a known ClearFake domain
  Example: A system update job using wget or curl to fetch updates from clearfake.com/update
  Filter/Exclusion: Exclude URLs matching clearfake.com/update or any subdomain of clearfake.com used for legitimate system updates

• Scenario: Admin task using ClearFake for internal testing or phishing simulations
  Example: An admin manually testing a phishing email using a ClearFake URL in a controlled environment
  Filter/Exclusion: Exclude URLs containing phishing-test or simulator in the path or query parameters

• Scenario: Automation tool using ClearFake for benign API calls
  Example: A DevOps tool like Ansible or Terraform using a ClearFake URL to access a mock API for testing
  Filter/Exclusion: Exclude URLs that match mock-api.clearfake.com or any URL with test in the domain or path

• Scenario: Legitimate software using ClearFake as a CDN or proxy
  Example: A company’s internal software using ClearFake as a CDN for static assets
  Filter/Exclusion: Exclude URLs that match cdn.clearfake.com or any URL with static or assets in the path

• Scenario: User-generated content with ClearFake URLs in a company blog or forum
  Example: A company blog post or internal forum entry containing a ClearFake URL as part of a legitimate link
  Filter/Exclusion: Exclude URLs that appear in content managed by a CMS like WordPress or Confluence, or URLs with blog or forum in the domain path