This hunt identifies the presence of ClearFake, a sophisticated fake antivirus scam that often serves as an initial access vector for deploying additional malware or ransomware. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect compromised endpoints before the adversary can establish persistence or execute lateral movement across the environment.
Malware Family: ClearFake Total IOCs: 36 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | elitebusinesschronicles.com | payload_delivery | 2026-09-13 | 90% |
| domain | americandreamlost.com | payload_delivery | 2026-09-13 | 90% |
| domain | alpha789.online | payload_delivery | 2026-09-13 | 90% |
| domain | carmencitaclub.org | payload_delivery | 2026-09-13 | 90% |
| domain | dev-coastal-road-repair.pantheonsite.io | payload_delivery | 2026-09-13 | 90% |
| domain | bestitchedembaws.cdn-alpha.com | payload_delivery | 2026-09-13 | 90% |
| domain | xbzbvp9g.remarq.store | payload_delivery | 2026-09-13 | 100% |
| domain | remarq.store | payload_delivery | 2026-09-13 | 100% |
| domain | x3lwqigl.kadec.store | payload_delivery | 2026-09-13 | 100% |
| domain | kadec.store | payload_delivery | 2026-09-13 | 100% |
| domain | qjdwk0h6.planus.store | payload_delivery | 2026-09-13 | 100% |
| domain | planus.store | payload_delivery | 2026-09-13 | 100% |
| domain | machine.cavalchalet.ch | payload_delivery | 2026-09-13 | 90% |
| domain | v1.kanopy.fr | payload_delivery | 2026-09-13 | 90% |
| domain | tzxecu85.heroe.store | payload_delivery | 2026-09-13 | 100% |
| domain | 1mataw10.moltem.store | payload_delivery | 2026-09-13 | 100% |
| domain | moltem.store | payload_delivery | 2026-09-13 | 100% |
| domain | heroe.store | payload_delivery | 2026-09-13 | 100% |
| domain | zcrq6pvf.pesas.store | payload_delivery | 2026-09-13 | 100% |
| domain | jtd3m9p0.jurni.store | payload_delivery | 2026-09-13 | 100% |
| domain | jurni.store | payload_delivery | 2026-09-13 | 100% |
| domain | 7bkjh5ns.palso.store | payload_delivery | 2026-09-13 | 100% |
| domain | palso.store | payload_delivery | 2026-09-13 | 100% |
| domain | u2dqx82e.mard.store | payload_delivery | 2026-09-13 | 100% |
| domain | omckf2vc.omec.store | payload_delivery | 2026-09-13 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["elitebusinesschronicles.com", "americandreamlost.com", "alpha789.online", "carmencitaclub.org", "dev-coastal-road-repair.pantheonsite.io", "bestitchedembaws.cdn-alpha.com", "xbzbvp9g.remarq.store", "remarq.store", "x3lwqigl.kadec.store", "kadec.store", "qjdwk0h6.planus.store", "planus.store", "machine.cavalchalet.ch", "v1.kanopy.fr", "tzxecu85.heroe.store", "1mataw10.moltem.store", "moltem.store", "heroe.store", "zcrq6pvf.pesas.store", "jtd3m9p0.jurni.store", "jurni.store", "7bkjh5ns.palso.store", "palso.store", "u2dqx82e.mard.store", "omckf2vc.omec.store", "uhtu2p9o.ghadi.store", "omec.store", "mard.store", "ghadi.store", "miqmh80v.bosskayseri.store", "bosskayseri.store", "4rqjjify.omars.store", "omars.store", "noug.store", "pos.amirtham.org", "numerologie-brittavonb.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
clearfake as a lightweight, open-source alternative to fake for mocking HTTP services in local development environments or CI/CD pipelines (e.g., within a Docker container or Kubernetes pod) to test API integrations.
docker, containerd-shim, crio) or where the working directory is within a known development path (e.g., /home/dev/, /opt/ci/, /var/lib/kubelet/).clearfake as a temporary decoy or honeypot service on a non-production network segment to observe attacker behavior or validate detection coverage without impacting production workloads.
Sec-Testing-Team) or where the host is in a non-production VLAN/subnet (e.g., 10.20.0.0/24 designated for lab environments).clearfake on a jump host or bastion server to simulate a backend dependency that is currently down, allowing them to debug client-side logic without waiting for the upstream service to be restored.
bastion-* or jump-*) and where the process is short-lived (e.g., terminated within 15 minutes of start).clearfake in a Jupyter Notebook or Python script to generate synthetic test data for machine learning model validation, running it in a virtual environment or conda environment.