ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against 65 specific Indicators of Compromise (IOCs) linked to the ClearFake malware campaign. Proactively hunting for these IOCs is critical because ClearFake often employs sophisticated evasion techniques that may bypass standard signature-based defenses, requiring manual investigation to confirm early-stage infections before lateral movement occurs.

IOC Summary

Malware Family: ClearFake Total IOCs: 65 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	erubhug7.eng-slimsounds.com	payload_delivery	2026-08-17	100%
domain	gokyarinsaat.com	payload_delivery	2026-08-17	90%
domain	actualitatdiaria.com	payload_delivery	2026-08-17	90%
domain	mplify-ph.com	payload_delivery	2026-08-17	90%
domain	liyajun.com	payload_delivery	2026-08-17	90%
domain	j-fire.com	payload_delivery	2026-08-17	90%
domain	erasafe.com	payload_delivery	2026-08-17	90%
domain	buychistraightener.com	payload_delivery	2026-08-17	90%
domain	quaisdeparis.com	payload_delivery	2026-08-17	90%
domain	fruchtmeister.de	payload_delivery	2026-08-17	90%
domain	proizvodnja-peka.com	payload_delivery	2026-08-17	90%
domain	ajpublishing.com	payload_delivery	2026-08-17	90%
domain	arabictests.com	payload_delivery	2026-08-17	90%
domain	emovimiento.com.mx	payload_delivery	2026-08-17	90%
domain	myrootsweb.com	payload_delivery	2026-08-17	90%
domain	rememberingmichelle.org	payload_delivery	2026-08-17	90%
domain	feiern-in-dortmund.de	payload_delivery	2026-08-17	90%
domain	eventimpact.org	payload_delivery	2026-08-17	90%
domain	wepray4spain.com	payload_delivery	2026-08-17	90%
domain	brled.com.br	payload_delivery	2026-08-17	90%
domain	horizoninfo.fr	payload_delivery	2026-08-17	90%
domain	megaterasoln.com	payload_delivery	2026-08-17	90%
domain	axel-klatt.de	payload_delivery	2026-08-17	90%
domain	papain.in	payload_delivery	2026-08-17	90%
domain	gavialholdings.com	payload_delivery	2026-08-17	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["erubhug7.eng-slimsounds.com", "gokyarinsaat.com", "actualitatdiaria.com", "mplify-ph.com", "liyajun.com", "j-fire.com", "erasafe.com", "buychistraightener.com", "quaisdeparis.com", "fruchtmeister.de", "proizvodnja-peka.com", "ajpublishing.com", "arabictests.com", "emovimiento.com.mx", "myrootsweb.com", "rememberingmichelle.org", "feiern-in-dortmund.de", "eventimpact.org", "wepray4spain.com", "brled.com.br", "horizoninfo.fr", "megaterasoln.com", "axel-klatt.de", "papain.in", "gavialholdings.com", "greenandgoldenglish.es", "emailmarket.net", "onno-partners.com", "hospycare.com", "lobs.eu", "fzrc5.com", "nathanstewart.ca", "speedtravaux.com", "miincomejobloss.com", "zolf.net", "thenewpage.net", "natalymotta.com", "xerolas.eu", "unulight.com", "artistheart.com", "construire-naturel.com", "cedarparksuites.com", "saintxandre-handball.com", "inforadioterapia.com", "motorscenter.com.br", "therefineryrock.com", "firetron.co.uk", "fin-web.cz", "esperanzafernandez.com", "itsapparelworld.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with suggested filters or exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Endpoint Protection Scans by Defender for Endpoint

  • Context: Microsoft Defender for Endpoint (MDE) performs scheduled “On-Demand” scans that query the local threat intelligence database. This process often generates network traffic to internal or external reputation servers matching ClearFake IOCs, mimicking a potential compromise.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., MsMpEng.exe, SenseAgent.exe) and User Account (SYSTEM). Additionally, exclude traffic originating from the specific IP range of the internal MDE management server if it initiates these queries.

• Scenario: Scheduled Vulnerability Assessment by Qualys or Tenable

  • Context: Enterprise vulnerability scanners (such as Qualys Cloud Agent or Tenable Nessus) run nightly jobs to validate asset posture. During the “Agent Check-in” phase, these tools frequently resolve and query known threat intelligence feeds, triggering hits against ClearFake IOCs as part of their standard baseline verification.
  • Suggested Filter/Exclusion: Implement a time-based exclusion (e.g., 02:00 – 04:00 UTC) for processes named qualyspc.exe or tenable-agent. Alternatively, filter out events where the Source Port corresponds to the scanner’s heartbeat port and the destination is a known internal feed aggregator.

• Scenario: SIEM Log Ingestion by Splunk or Sentinel

  • Context: The organization’s central SIEM (e.g., Microsoft Sentinel or Splunk Enterprise) periodically pulls threat intelligence updates from external feeds to enrich incoming logs. This ingestion process involves the SI