ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt hypothesis posits that adversaries are actively deploying ClearFake malware to establish persistence and exfiltrate sensitive data by leveraging its known set of 13 Indicators of Compromise (IOCs). Proactively hunting for these specific IOCs within Azure Sentinel is critical because early detection allows the SOC team to identify compromised endpoints before the malware can fully execute its command-and-control routines, thereby minimizing potential data loss.

IOC Summary

Malware Family: ClearFake Total IOCs: 13 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["1v6qcobc.betbuf.live", "bcxmyrgq.betbuf.live", "rjjgfvu6.vip1xbet.org", "c0yc77zn.blackjackonlineplay83.com", "2ffuyto6.taktikbet.bio", "cd5p7l7t.xbetone.com", "t71awqhc.1xsignupbet.com", "1e2sdyr4.honardartarikh.xyz", "ccczqxl6.blackjackonlineplay83.com", "hzks2llo.1xdownload2023.com", "e.perspolis.pro", "tb4awyc7.vip1xbet.net", "bcb7ukdo.tinyshart.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Scanning and Quarantine Operations

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan. During this process, the EDR engine downloads the latest definition updates which include signatures matching ClearFake IOCs to quarantine known benign files that mimic these indicators before they are fully analyzed by the SIEM.
  • Filter/Exclusion: Exclude network traffic and file hash events originating from specific EDR management servers (e.g., CrowdStrike-Manager-01) or filter out processes running under the System account with a parent process of mpcmdrun.exe or csagent.exe.

• Automated Vulnerability Management Scans

  • Scenario: The enterprise runs nightly vulnerability assessments using Tenable Nessus. When scanning web servers, Nessus actively probes endpoints for known threats and may generate temporary connections to the ClearFake IOC IP addresses or download test payloads that trigger the detection logic as “suspicious activity” even though they are part of a standard maintenance window.
  • Filter/Exclusion: Create an exclusion rule based on the source asset tag (e.g., AssetRole=VulnScanner) and restrict the alert to only fire outside of the defined maintenance window (e.g., 02:00 – 04:00 UTC) or exclude traffic from the Nessus scanner’s dedicated service account.

• Third-Party Cloud Backup and Synchronization Jobs

  • Scenario: A scheduled backup job using Veeam Backup & Replication or Microsoft Azure Data Box initiates a synchronization task