ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of 47 known indicators of compromise associated with the ClearFake threat actor, enabling the detection of potential intrusions through specific file paths, registry keys, or network artifacts. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage malicious activity and contain the threat before it can establish persistence or execute further post-compromise actions.

IOC Summary

Malware Family: ClearFake Total IOCs: 47 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
domain	proyectoleen.org	payload_delivery	2026-09-07	90%
domain	puertonu.com	payload_delivery	2026-09-07	90%
domain	www.prophegy.com	payload_delivery	2026-09-07	90%
domain	przestworze.pl	payload_delivery	2026-09-07	90%
domain	psychotherapie-in-erding.de	payload_delivery	2026-09-07	90%
domain	d9mjs.sbs	payload_delivery	2026-09-07	90%
domain	8qu7g5ql.www-bellyflush.com	payload_delivery	2026-09-07	100%
domain	goodmorningsweetheart.com	payload_delivery	2026-09-07	100%
domain	gharoga.com	payload_delivery	2026-09-07	100%
domain	3wjg7a6v.us-theeloncode.com	payload_delivery	2026-09-07	100%
domain	pmr5120.ovh	payload_delivery	2026-09-07	90%
domain	pizzagavarres.com	payload_delivery	2026-09-07	90%
domain	preprod.kaiman.fr	payload_delivery	2026-09-07	90%
domain	playsand.com.br	payload_delivery	2026-09-07	90%
domain	playersconnection.de	payload_delivery	2026-09-07	90%
domain	primotazzestozze.it	payload_delivery	2026-09-07	90%
domain	plusscrapmetalrecycling.com	payload_delivery	2026-09-07	90%
domain	primequality.tur.br	payload_delivery	2026-09-07	90%
domain	pmcevolutioncorp.com	payload_delivery	2026-09-07	90%
domain	povoljneaviokarte.com	payload_delivery	2026-09-07	90%
domain	pricerightautomotive.net	payload_delivery	2026-09-07	90%
domain	princetexint.co.zw	payload_delivery	2026-09-07	90%
domain	prindustriales.com	payload_delivery	2026-09-07	90%
domain	pinklemonade.es	payload_delivery	2026-09-07	90%
domain	preluence.com	payload_delivery	2026-09-07	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["proyectoleen.org", "puertonu.com", "www.prophegy.com", "przestworze.pl", "psychotherapie-in-erding.de", "d9mjs.sbs", "8qu7g5ql.www-bellyflush.com", "goodmorningsweetheart.com", "gharoga.com", "3wjg7a6v.us-theeloncode.com", "pmr5120.ovh", "pizzagavarres.com", "preprod.kaiman.fr", "playsand.com.br", "playersconnection.de", "primotazzestozze.it", "plusscrapmetalrecycling.com", "primequality.tur.br", "pmcevolutioncorp.com", "povoljneaviokarte.com", "pricerightautomotive.net", "princetexint.co.zw", "prindustriales.com", "pinklemonade.es", "preluence.com", "www.pkeuro.net", "shal2vr2.us-us-us-glucore.com", "us-us-us-glucore.com", "pantherchile.com", "1szmvih8.www-cardioslim.com", "parachevement-bartos.be", "paviotfoto.com", "www.perlabeautyhome.hu", "xella.pipp.is", "onric.es", "onclickcart.com", "nisw.co.za", "nimzara.com", "nissan.operations-rousseau-automobile.fr", "www.nsinailsthailand.com", "o7-organic.com", "normannpetkau.de", "relay.backupper.pro", "2a2m8vsh.www-trumpgoldenbadge.com", "colloques.labomgd.ch", "mylittlemalta.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/cowenrty/probing/related"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A security operations team uses a SIEM or EDR platform (e.g., CrowdStrike, SentinelOne) to ingest and correlate ThreatFox ClearFake IOCs for automated hunting. The ingestion process may temporarily write IOC files or memory snapshots to disk or network shares, matching the file paths or hash values in the rule.
  • Filter/Exclusion: Exclude processes originating from known security tool binaries (e.g., csagent.exe, sentinelone.exe) or restrict the rule to non-security service accounts.
• Scenario: An IT administrator performs a manual malware scan using a portable version of a tool like Malwarebytes or ESET NOD32 that includes the ClearFake IOC set in its local database. The scanning engine loads these IOCs into memory or creates temporary cache files in the user’s profile or temp directories.
  • Filter/Exclusion: Exclude file paths under standard temporary directories (e.g., C:\Users\<User>\AppData\Local\Temp\) or exclude processes with names like mbam.exe or esetsvc.exe.
• Scenario: A DevOps engineer runs a CI/CD pipeline job that includes a step to validate threat intelligence feeds by downloading and parsing the latest ClearFake IOC list from a public repository or internal feed service. The pipeline may store the raw IOC data in a build artifact directory or a shared network drive for audit purposes.
  • Filter/Exclusion: Exclude paths associated with build agents or CI/CD workspaces (e.g., C:\jenkins\workspace\, D:\ci_cd\artifacts\) or exclude service accounts used by CI/CD systems (e.g., svc_ci_cd).
• Scenario: A data analyst or threat intelligence researcher uses a Python script or Jupyter notebook to analyze ClearFake IOCs for a report. The script may write intermediate