ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of ClearFake IOCs, a tool frequently used by adversaries to spoof browser fingerprints and evade detection during web-based intrusions. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or active sessions before attackers leverage this obfuscation to establish persistence or exfiltrate data.

IOC Summary

Malware Family: ClearFake Total IOCs: 12 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["team-building-strasbourg.fr", "symbioticenergy.net", "talrise.com", "tattoonhatrang.com", "wergfxqe.www-cardioslim.com", "zian1d9k.blowfemme.com", "prudenceflores.com", "www.popieriniaipuodeliai.lt", "fgnr9ilf.pura--boost.us", "pspilates.es", "nextecho.org", "mbq5b6qe.nelloconstruction.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A security operations team deploys a new threat intelligence feed via a SIEM integration (e.g., Splunk, QRadar) that automatically ingests and correlates IOCs from the ClearFake dataset for baseline visibility.
  • Filter/Exclusion: Exclude events where the source user is a service account (e.g., svc-siem-integration or threat-intel-sync) or where the process name is a known SIEM agent (e.g., splunkd.exe, qradar_agent).
• Scenario: An IT administrator runs a scheduled PowerShell script to audit and validate IOC coverage across the environment, which explicitly queries or references the ClearFake IOC list stored in a shared CSV or database.
  • Filter/Exclusion: Exclude events originating from specific scheduled tasks (e.g., TaskName: "IOC-Audit-Monthly") or where the command line contains keywords like audit, validate, or coverage alongside the IOC reference.
• Scenario: A developer or DevOps engineer tests a new endpoint detection tool (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) in a non-production environment by injecting ClearFake IOCs to verify detection logic.
  • Filter/Exclusion: Exclude events from hosts tagged as Environment: Dev or Environment: Test, or where the user belongs to a group like devops-testers or security-lab.
• Scenario: A security analyst manually imports ClearFake IOCs into a local YARA rule file or Sigma rule repository for peer review, triggering file creation or modification events that match IOC patterns.
  • Filter/Exclusion: Exclude events where the file path contains directories like \\rules\\, \\sigma\\, or \\yara\\, or where the user is a member of the security-engineers group.