ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hypothesis targets the IClickFix attack technique, where adversaries exploit browser clickjacking to execute malicious code via a hidden iframe, often leading to credential theft or remote code execution. Proactively hunting for these IOCs in Azure Sentinel is critical because IClickFix can operate silently within user sessions, allowing attackers to establish a foothold before traditional endpoint detections trigger.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://www.motorway.nl", "https://www.motorway.nl/nochain-sw.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a GUI-based installer (e.g., winget, choco, or a custom .exe wrapper) that internally invokes cmd.exe or powershell.exe to execute setup scripts, resulting in process creation chains that match the IClickFix IOC patterns (e.g., cmd.exe spawning powershell.exe with specific argument strings).

  • Filter/Exclusion: Exclude processes where the parent executable is a known package manager binary (e.g., winget.exe, choco.exe, scoop.exe) or where the command line contains standard installer flags like /install, /silent, or /quiet.

• Scenario: An IT administrator runs a scheduled task or PowerShell script to update legacy Java or .NET frameworks, which involves downloading a .jar or .dll file and executing it via java.exe or msiexec.exe, potentially triggering IOC matches related to file execution from temporary directories or specific argument patterns.

  • Filter/Exclusion: Exclude executions where the parent process is msiexec.exe or java.exe and the file path resides in standard system update directories (e.g., C:\Windows\Temp, C:\Program Files\Java, or C:\Program Files\dotnet).

• Scenario: A security team or application owner performs a manual penetration test or vulnerability scan using tools like nmap or masscan that spawn child processes to execute probes, creating process trees that mimic the IClickFix attack chain (e.g., cmd.exe -> powershell.exe -> cmd.exe).

  • Filter/Exclusion: Exclude events where the initiating user account belongs to a dedicated security or test group (e.g., SEC_TESTERS, PEN_TEST) or where the source IP address is within the internal