This hunt detects adversary activity linked to the ClearFake campaign by identifying the presence of its specific Indicators of Compromise (IOCs) within the Azure Sentinel environment. Proactively hunting for these signals is critical because ClearFake represents a high-severity threat vector that often targets enterprise networks, requiring immediate identification and containment to prevent potential data exfiltration or lateral movement.
Malware Family: ClearFake Total IOCs: 22 IOC Types: domain, url, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | centre-colibri.ch | payload_delivery | 2026-08-14 | 90% |
| domain | rabvsryhs.phim18k.de | payload_delivery | 2026-08-14 | 100% |
| domain | naisa.com.gt | payload_delivery | 2026-08-14 | 90% |
| domain | qdfck9el.crownconnectpk.com | payload_delivery | 2026-08-14 | 100% |
| domain | wsjmpkkq.usa--sightfresh.com | payload_delivery | 2026-08-14 | 100% |
| domain | 28r8x9d2.get-goldalign.com | payload_delivery | 2026-08-14 | 100% |
| domain | wohndekor.li | payload_delivery | 2026-08-14 | 90% |
| sha256_hash | fcc3e935fa91e60f7a5746dd70c7361aa40c8a73b16bdbd13f99b6cb2c8a1918 | payload | 2026-08-14 | 90% |
| domain | bungee-fit.ch | payload_delivery | 2026-08-14 | 90% |
| domain | castella-sports.ch | payload_delivery | 2026-08-14 | 90% |
| sha256_hash | 734c7ad863767dbbcb39c57b3c6905c6df158988d50b0ff4253318e65f4f241c | payload | 2026-08-14 | 90% |
| domain | pjdxbok5.fus-u8k8fs-8.buzz | payload_delivery | 2026-08-14 | 100% |
| domain | f1mrikc1.us-theslimsplitsmethod.com | payload_delivery | 2026-08-14 | 100% |
| url | hxxps://cdn.jsdelivr.net/gh/kud-981/kirby-s1@3859d64/kk-w7 | payload_delivery | 2026-08-14 | 100% |
| url | hxxps://digitalenterprise2026.com/ZxC9vBnM7lKjH3gF | payload_delivery | 2026-08-14 | 90% |
| domain | cloudenterprise26.com | botnet_cc | 2026-08-14 | 90% |
| url | hxxps://cloudenterprise26.com/ZxC9vBnM7lKjH3gF | payload_delivery | 2026-08-14 | 90% |
| domain | voileterresainte.ch | payload_delivery | 2026-08-14 | 90% |
| domain | reguay.com | payload_delivery | 2026-08-14 | 90% |
| domain | siad-dakar.com | payload_delivery | 2026-08-14 | 90% |
| domain | saffronsynergies.in | payload_delivery | 2026-08-14 | 90% |
| domain | secureyourpocket.com | payload_delivery | 2026-08-14 | 90% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["centre-colibri.ch", "rabvsryhs.phim18k.de", "naisa.com.gt", "qdfck9el.crownconnectpk.com", "wsjmpkkq.usa--sightfresh.com", "28r8x9d2.get-goldalign.com", "wohndekor.li", "bungee-fit.ch", "castella-sports.ch", "pjdxbok5.fus-u8k8fs-8.buzz", "f1mrikc1.us-theslimsplitsmethod.com", "cloudenterprise26.com", "voileterresainte.ch", "reguay.com", "siad-dakar.com", "saffronsynergies.in", "secureyourpocket.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/kud-981/kirby-s1@3859d64/kk-w7", "https://digitalenterprise2026.com/ZxC9vBnM7lKjH3gF", "https://cloudenterprise26.com/ZxC9vBnM7lKjH3gF"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - ClearFake
let malicious_hashes = dynamic(["fcc3e935fa91e60f7a5746dd70c7361aa40c8a73b16bdbd13f99b6cb2c8a1918", "734c7ad863767dbbcb39c57b3c6905c6df158988d50b0ff4253318e65f4f241c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are the false positive scenarios and corresponding exclusions for the ThreatFox: ClearFake IOCs detection rule:
Enterprise Endpoint Protection Scans: The organization’s primary EDR solution, CrowdStrike Falcon, performs daily heuristic scans that query the internal threat intelligence feed containing ClearFake signatures. This triggers the rule when the EDR agent downloads or matches the specific 22 IOCs during a scheduled maintenance window.
CrowdStrike-Falcon-Service process ID (PID) or filter out events where the source IP belongs to the internal EDR management subnet (10.50.10.0/24).Automated Threat Intelligence Ingestion Job: A nightly scheduled task running on the Microsoft Azure Sentinel ingestion server pulls updates from the ClearFake threat feed via an API call. This job executes every Sunday at 03:00 UTC, generating network connections that match the ClearFake IOCs as part of standard data synchronization.
02:45 and 03:15 on Sundays where the source hostname contains Azure-Sentinel-Integrator.Security Operations Center (SOC) Manual Verification: During routine threat hunting exercises, SOC analysts manually query the ClearFake database using Splunk dashboards to validate new indicators. This manual lookup generates a burst of traffic matching the 22 IOCs as the analyst’s workstation connects to the intelligence repository.
SOC-Analysts Active Directory group and the source device is identified as a corporate laptop (e.g., DeviceType: Laptop).Third-Party Vulnerability Management Scan: The internal vulnerability scanner, **Tenable