The ThreatFox: ClearFake IOCs rule detects potential adversary activity associated with the ClearFake malware, which is known for distributing malicious payloads through compromised websites and phishing campaigns. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage attacks that could lead to data exfiltration or system compromise.
IOC Summary
Malware Family: ClearFake Total IOCs: 37 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | formkey.asia | payload_delivery | 2026-05-22 | 100% |
| domain | chickencutlet-hacks.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | chroniclearchivekeeper.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | logicbufferskills.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | pixelart-canvas.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | vintagevinylrestoration.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | trading-academyexpert.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | finger.linkedco.net | payload_delivery | 2026-05-22 | 100% |
| domain | linkedco.net | payload_delivery | 2026-05-22 | 100% |
| domain | neon-cyberpunk.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | linguisticpuzzlesolver.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | subterranean-mineral.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | smartworkflowmanagement.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | ancientparchmentarchive.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | orbital-mechanics.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | cyber-defensepro.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | quantumvelocitylabs.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | lasagna-bakingpro.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | stack-control-plane.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | runtime-processing-node.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | telemetrymesh.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | byte-network-hub.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | signal-routing-framework.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | proxy-stream.christmas | payload_delivery | 2026-05-22 | 100% |
| domain | kernel-control-engine.christmas | payload_delivery | 2026-05-22 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["formkey.asia", "chickencutlet-hacks.christmas", "chroniclearchivekeeper.christmas", "logicbufferskills.christmas", "pixelart-canvas.christmas", "vintagevinylrestoration.christmas", "trading-academyexpert.christmas", "finger.linkedco.net", "linkedco.net", "neon-cyberpunk.christmas", "linguisticpuzzlesolver.christmas", "subterranean-mineral.christmas", "smartworkflowmanagement.christmas", "ancientparchmentarchive.christmas", "orbital-mechanics.christmas", "cyber-defensepro.christmas", "quantumvelocitylabs.christmas", "lasagna-bakingpro.christmas", "stack-control-plane.christmas", "runtime-processing-node.christmas", "telemetrymesh.christmas", "byte-network-hub.christmas", "signal-routing-framework.christmas", "proxy-stream.christmas", "kernel-control-engine.christmas", "cloudruntime.christmas", "packet-distribution-core.christmas", "container-mesh.christmas", "telemetry-control-hub.christmas", "stackbridge.christmas", "network-flow-system.christmas", "byte-vault.christmas", "signal-processing-core.christmas", "proxy-hub.christmas", "cloud-sync-engine.christmas", "microservice-hub.christmas", "telemetry-grid.christmas"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate System Maintenance Task
Description: A system administrator is running a scheduled job to clean up temporary files using a tool like cleanmgr.exe or diskcleanup.exe.
Filter/Exclusion: Exclude processes associated with cleanmgr.exe or diskcleanup.exe using the process.name field.
Scenario: Antivirus Scan Using Windows Defender
Description: Windows Defender is performing a scheduled scan, which may trigger IOCs related to malware detection.
Filter/Exclusion: Exclude processes with process.name containing Windows Defender or MsMpEng.exe.
Scenario: Log Collection and Analysis Tool (e.g., Splunk, ELK Stack)
Description: A log analysis tool like Splunk or the ELK stack is ingesting and processing logs, which may include benign network activity or file paths.
Filter/Exclusion: Exclude processes with process.name matching splunkd.exe, logstash, or elasticsearch.
Scenario: Software Update or Patch Deployment
Description: A patch management tool such as Microsoft Endpoint Manager or SCCM is deploying updates, which may include known malicious IOCs in its update packages.
Filter/Exclusion: Exclude processes with process.name matching setup.exe, msiexec.exe, or sccmclient.exe.
Scenario: Network Monitoring Tool (e.g., Wireshark, tcpdump)
Description: A network monitoring tool like Wireshark or tcpdump is capturing traffic, which may include benign IP addresses or domains listed in the ClearFake IOC list.
Filter/Exclusion: Exclude processes with process.name matching wireshark.exe, tcpdump, or nmap.exe.