ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of known ClearFake IOCs, which are frequently leveraged by threat actors to establish initial access or execute malicious payloads within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: ClearFake Total IOCs: 14 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["aah3bpf6.eng-eng-glucore.com", "fflupuez.smartwaterbox.us", "smartwaterbox.us", "suibzkdc.wece.store", "wece.store", "3jrj8nat.americaeaglependant.com", "up3c3qqw.shop-zensulin.us", "shop-zensulin.us", "agostinobruno.com", "tudfpifq.shop-glpro.com", "shop-glpro.com", "kq36oivv.eng-cardioslim.com", "h3tnyjph.vuhw.store", "vuhw.store"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A DevOps engineer deploys a new version of a custom internal security scanner or threat intelligence aggregator that includes a specific ClearFake IOC (e.g., a known hash or URL) in its configuration file or database to test detection coverage.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalSecTools\) or exclude processes named sec-scanner.exe or ti-aggregator.exe when they access the IOC files.

• Scenario: An IT administrator runs a scheduled PowerShell script to update the endpoint protection policy, which downloads a new threat intelligence feed containing ClearFake IOCs from an internal repository server.

  • Filter/Exclusion: Exclude network connections to the internal repository server IP (e.g., 10.10.5.20) initiated by the powershell.exe process if the parent process is a scheduled task service (svchost.exe with Task Scheduler as the parent) or if the user is a member of the IT-Admins AD group.

• Scenario: A security analyst performs a manual hunt and creates a temporary folder on their workstation to store sample files or IOC lists for analysis, including the ClearFake IOCs for comparison.

  • Filter/Exclusion: Exclude file creation or access events in user-specific temporary directories (e.g., C:\Users\<AnalystName>\AppData\Local\Temp\ or C:\Users\<AnalystName>\Desktop\HuntSamples\) if the user is a member of the SOC-Analysts AD group and the file extension matches common IOC list formats (.txt, .csv, .json).

• Scenario: A CI/CD pipeline job runs a static analysis tool that scans code repositories for known malicious patterns, including ClearFake IOCs, as