URLhaus: ClearFake Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access known ClearFake phishing or malware distribution URLs identified by URLhaus, indicating potential initial compromise or lateral movement attempts. The SOC team should proactively investigate these signals in Azure Sentinel to rapidly isolate affected assets and prevent data exfiltration before the malicious payloads execute fully.

IOC Summary

Threat: ClearFake Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClearFake
let malicious_domains = dynamic(["tniukh64.bitbet.download", "jbqh.betaverse.casino", "adewbrfg.bet90forward.win", "hlme.bet90forward.app", "uzmapubv.behtarin-site-shartbandi-football.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["tniukh64.bitbet.download", "jbqh.betaverse.casino", "adewbrfg.bet90forward.win", "hlme.bet90forward.app", "uzmapubv.behtarin-site-shartbandi-football.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClearFake Malicious URLs detection rule, tailored for an enterprise environment:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently perform background checks against known malicious URL repositories to update their local threat intelligence feeds. These agents may query the clearfake.com infrastructure or its associated CDN endpoints, triggering a hit if the specific URL is flagged as “ClearFake” but represents a legitimate vendor communication channel rather than active malware.
  • Suggested Filter: Exclude traffic originating from the internal IP ranges of the Endpoint Management Server (e.g., 10.20.30.x for SCCM or Intune management nodes) and restrict the rule to only flag URLs accessed by interactive user sessions, excluding service accounts running update jobs.

• Scheduled Vulnerability Assessment Scans

  • Scenario: Scheduled vulnerability scanners (such as Tenable Nessus or Qualys) periodically probe external web resources to validate SSL certificates and check for known vulnerabilities. During a “Web Application Scan,” the scanner may visit URLs hosted on ClearFake domains that are part of the organization’s approved vendor list, generating alerts because the scanner’s headless browser engine accesses these links without user interaction context.
  • Suggested Filter: Create an exclusion based on the User-Agent string containing specific identifiers for vulnerability scanners (e.g., Tenable-Nessus, QualysAgent) and filter out events where the HTTP response code is 200 OK with a low dwell time (<5 seconds), indicating a quick probe rather than a user browsing session.

• IT Helpdesk Ticketing System Integration

  • Scenario: The organization’s IT Service Management (ITSM) platform, such as ServiceNow or J