URLhaus: ClickFix Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging the ClickFix malware family to distribute malicious payloads through compromised or newly registered web domains that users may inadvertently access. Proactively hunting these specific URL signatures in Azure Sentinel is critical because ClickFix often employs rapid domain-flipping tactics that can bypass static allow-lists, requiring real-time behavioral analysis to prevent initial infection and lateral movement.

IOC Summary

Threat: ClickFix Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ClickFix
let malicious_domains = dynamic(["marjdl.pro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["marjdl.pro"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ClickFix Malicious URLs detection rule, including tailored filters and exclusions:

• Scheduled Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint management tools (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently scan external software repositories to check for the latest definitions. These agents often query clickfix.com or related subdomains to validate update signatures before pushing patches to workstations. The high volume of automated requests from the agent service account can be misidentified as user-initiated malicious browsing activity.
  • Filter/Exclusion: Create a rule exclusion for traffic originating from specific Service Accounts (e.g., svc-falcon-updater, defender-agent) or restrict the detection to exclude traffic where the User Agent string contains known endpoint management identifiers (e.g., CrowdStrike-Update-Agent or Microsoft Defender Antivirus).

• IT Helpdesk Ticketing System Integration

  • Scenario: The organization’s IT Service Management platform (e.g., Jira Service Management, ServiceNow) integrates with ClickFix for asset management or remote support ticket resolution. When an administrator resolves a hardware issue via the portal, the system automatically triggers background API calls to fetch device metadata from ClickFix URLs. These legitimate backend integrations generate HTTP requests that match the malicious URL pattern but are initiated by the application server rather than a user browser.
  • Filter/Exclusion: Exclude traffic originating from the Application Server IP range (e.g., 10.20.50.0/24 for the ServiceNow cluster) or filter out requests where the HTTP Method is POST/PUT with a payload size > 5KB, which typically indicates an API integration rather than a simple user click-through.

• **Automated Browser Health Checks by