This hunt targets adversary activity involving known indicators of compromise from the IClickFix campaign to identify potential lateral movement or data exfiltration within the Azure environment. Proactively searching for these specific IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate affected assets before the threat actor can establish persistence or escalate privileges across the cloud infrastructure.
Malware Family: IClickFix Total IOCs: 29 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | mistertwister.sale | payload_delivery | 2026-06-28 | 100% |
| domain | www.emanulquran.com | payload_delivery | 2026-06-27 | 100% |
| domain | www.pourosdevelopments.com | payload_delivery | 2026-06-27 | 100% |
| domain | wwwjcpenneysurvey.store | payload_delivery | 2026-06-27 | 100% |
| domain | myopinion-deltaco.info | payload_delivery | 2026-06-27 | 100% |
| domain | mywawavisitscom.info | payload_delivery | 2026-06-27 | 100% |
| domain | nexel-drive.com | payload_delivery | 2026-06-27 | 100% |
| domain | purplebandage.org.za | payload_delivery | 2026-06-27 | 100% |
| domain | talktohannafordcom.store | payload_delivery | 2026-06-27 | 100% |
| domain | talktostopandshop.pro | payload_delivery | 2026-06-27 | 100% |
| domain | thespeedyhomeoffer.com | payload_delivery | 2026-06-27 | 100% |
| domain | trendomart.xyz | payload_delivery | 2026-06-27 | 100% |
| domain | valuevillagelistencom.store | payload_delivery | 2026-06-27 | 100% |
| domain | valuevillagelistenscom.casa | payload_delivery | 2026-06-27 | 100% |
| domain | cgain.net | payload_delivery | 2026-06-27 | 100% |
| domain | churchschickenfeedback.org | payload_delivery | 2026-06-27 | 100% |
| domain | culpritonline.com | payload_delivery | 2026-06-27 | 100% |
| domain | dgcustumrfirst.shop | payload_delivery | 2026-06-27 | 100% |
| domain | dqfanfeedbackfreedillybar.live | payload_delivery | 2026-06-27 | 100% |
| domain | dqfanfeedbacks.space | payload_delivery | 2026-06-27 | 100% |
| domain | dupat.ae | payload_delivery | 2026-06-27 | 100% |
| domain | emdgroupe.com | payload_delivery | 2026-06-27 | 100% |
| domain | ezbadvogados.com.br | payload_delivery | 2026-06-27 | 100% |
| domain | healthbloglonglife.com | payload_delivery | 2026-06-27 | 100% |
| domain | hollytree-transport.co.uk | payload_delivery | 2026-06-27 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["mistertwister.sale", "www.emanulquran.com", "www.pourosdevelopments.com", "wwwjcpenneysurvey.store", "myopinion-deltaco.info", "mywawavisitscom.info", "nexel-drive.com", "purplebandage.org.za", "talktohannafordcom.store", "talktostopandshop.pro", "thespeedyhomeoffer.com", "trendomart.xyz", "valuevillagelistencom.store", "valuevillagelistenscom.casa", "cgain.net", "churchschickenfeedback.org", "culpritonline.com", "dgcustumrfirst.shop", "dqfanfeedbackfreedillybar.live", "dqfanfeedbacks.space", "dupat.ae", "emdgroupe.com", "ezbadvogados.com.br", "healthbloglonglife.com", "hollytree-transport.co.uk", "jcpeneycomsurvey.info", "metroindonesia.id", "airtek.vn", "balanga.studio"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:
Legitimate Patch Management Scans
svc-crowdstrike, LocalSystem) when accessing paths under C:\Program Files\IClickFix\ or C:\Users\Public\Documents\IClickFix.Automated Backup and Archive Jobs
Backup-Server-01 through Backup-Server-05, specifically filtering out process names like vbr.exe or cvpagent.exe.IT Helpdesk Admin Configuration Updates