URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving user interactions with malicious URLs identified by URLhaus as part of the ClickFix campaign, which are known to deliver targeted payloads or phishing content. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromise attempts and prevent potential lateral movement or data exfiltration driven by this specific threat cluster.

IOC Summary

Threat: ClickFix Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["daleeby.com", "scuttlepopdownload.monster"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["daleeby.com", "scuttlepopdownload.monster"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ClickFix Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints. When these tools scan public-facing web assets, they may generate requests to URLs that the ClickFix heuristic flags as suspicious due to high entropy or specific URL structures common in modern SaaS applications.
  • Filter/Exclusion: Create a rule exclusion based on the Source IP matching the dedicated subnet of security appliances (e.g., 10.50.20.0/24) and filter out events where the User-Agent string contains keywords like “Tenable,” “Qualys,” or “Nessus.”

• Scenario: Scheduled Software Update & Patching Jobs

  • Context: Enterprise management tools (e.g., Microsoft Endpoint Configuration Manager, Ivanti Neurons, or Jamf) execute nightly scheduled jobs to download patches and update definitions. These agents often connect to vendor distribution points that utilize dynamic URL parameters, which can trigger the ClickFix detection logic due to complex query strings resembling known malicious patterns.
  • Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 02:00 - 04:00 UTC) where the Process Name matches update agents such as ccmexec.exe, jamfproagentd, or ivanti_agent_service.

• Scenario: Legitimate Marketing & CRM Campaigns

  • Context: Sales and marketing teams utilize platforms like Salesforce, HubSpot, or Marketo to distribute campaign links. These URLs