URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging ClickFix social engineering attacks to trick users into executing malicious code by visiting compromised URLs, a technique that often bypasses traditional perimeter defenses. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify potentially compromised endpoints before the attacker achieves full command-and-control or lateral movement within the environment.

IOC Summary

Threat: ClickFix Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["spa-com.com", "liikepalvelu.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["spa-com.com", "liikepalvelu.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A developer or DevOps engineer is testing a new internal microservice or API endpoint that has been temporarily registered in the URLhaus database for tracking purposes, or is using a staging environment URL that matches the known ClickFix pattern (e.g., https://clickfix[.]com/api/v1/test).

  • Filter/Exclusion: Exclude source IPs belonging to the dev-test or staging subnets, or exclude processes like curl, wget, or python (specifically requests library) when the destination port is 80/443 and the user account is tagged as service-account or developer.

• Scenario: A security team is performing a red team exercise or a phishing simulation campaign where they intentionally deploy a ClickFix-style lure to test user awareness, using a known URL from the URLhaus list to mimic real-world attacks.

  • Filter/Exclusion: Create a dynamic exclusion list for known red team infrastructure IPs or specific user accounts tagged as red-team or security-ops. Additionally, exclude events where the source process is powershell.exe or cmd.exe and the command line contains arguments like -ExecutionPolicy Bypass or Invoke-WebRequest with a -UserAgent header set to RedTeam.

• Scenario: An automated backup or sync tool (e.g., Veeam, Commvault, or a custom Python script) is pulling metadata or configuration files from a third-party SaaS provider that happens to host a resource at a URL matching the ClickFix pattern, possibly due to a shared CDN or misconfigured domain aliasing.

  • Filter/Exclusion: Exclude source processes known to be backup or sync agents (e.g., veeam.exe, commvault.exe, rsync, rclone). If the URL is accessed via a service