ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt identifies potential compromise by matching network traffic and endpoint telemetry against 27 known IOCs associated with the ClearFake malware family, which is frequently used for initial access and lateral movement. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect and isolate infected assets before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: ClearFake Total IOCs: 27 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
domain	`devtec.store`	payload_delivery	2026-09-12	100%
domain	`8a0jzezr.api24.store`	payload_delivery	2026-09-12	100%
domain	`51g2l83a.bvcbx.store`	payload_delivery	2026-09-12	100%
domain	`bvcbx.store`	payload_delivery	2026-09-12	100%
domain	`api24.store`	payload_delivery	2026-09-12	100%
domain	`advancedmolecularlabs.com`	payload_delivery	2026-09-12	90%
domain	`xjv0dj60.ddkg.store`	payload_delivery	2026-09-12	100%
domain	`ddkg.store`	payload_delivery	2026-09-12	100%
url	`hxxps://cdn.jsdelivr.net/gh/34-19-44r/E80F-BF-828-BD/C8-E1-62-16-BF-9E`	payload_delivery	2026-09-12	100%
url	`hxxps://cdn.jsdelivr.net/gh/34-19-44r/573-45-43cvi/AC-BC-FB-E2-30-46`	payload_delivery	2026-09-12	100%
url	`hxxps://cdn.jsdelivr.net/gh/maks-835/A4-BF-C7-85-1B-D65064-08/`	payload_delivery	2026-09-12	100%
url	`hxxps://cdn.jsdelivr.net/gh/48-689100-172-171440/708C-BB-236A/78-2106B1-D6C1`	payload_delivery	2026-09-12	100%
domain	`12jzlr7i.boano.store`	payload_delivery	2026-09-12	100%
domain	`boano.store`	payload_delivery	2026-09-12	100%
domain	`eng-stakebet.com`	payload_delivery	2026-09-12	90%
domain	`lnvhnjff.danya.store`	payload_delivery	2026-09-12	100%
domain	`kreatif.ch`	payload_delivery	2026-09-12	90%
domain	`danya.store`	payload_delivery	2026-09-12	100%
domain	`crea-mk.com`	payload_delivery	2026-09-12	90%
domain	`9vy7usty.alvare.store`	payload_delivery	2026-09-12	100%
domain	`xjbrbuwq.bosstekirdag.store`	payload_delivery	2026-09-12	100%
domain	`pnp2j4d0.damza.store`	payload_delivery	2026-09-12	100%
domain	`alvare.store`	payload_delivery	2026-09-12	100%
domain	`bosstekirdag.store`	payload_delivery	2026-09-12	100%
domain	`damza.store`	payload_delivery	2026-09-12	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["devtec.store", "8a0jzezr.api24.store", "51g2l83a.bvcbx.store", "bvcbx.store", "api24.store", "advancedmolecularlabs.com", "xjv0dj60.ddkg.store", "ddkg.store", "12jzlr7i.boano.store", "boano.store", "eng-stakebet.com", "lnvhnjff.danya.store", "kreatif.ch", "danya.store", "crea-mk.com", "9vy7usty.alvare.store", "xjbrbuwq.bosstekirdag.store", "pnp2j4d0.damza.store", "alvare.store", "bosstekirdag.store", "damza.store", "cdn-rcs-cloud.beer", "coba.rs"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/34-19-44r/E80F-BF-828-BD/C8-E1-62-16-BF-9E", "https://cdn.jsdelivr.net/gh/34-19-44r/573-45-43cvi/AC-BC-FB-E2-30-46", "https://cdn.jsdelivr.net/gh/maks-835/A4-BF-C7-85-1B-D65064-08/", "https://cdn.jsdelivr.net/gh/48-689100-172-171440/708C-BB-236A/78-2106B1-D6C1"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — ClearFake

False Positive Guidance

Legacy Browser Cache Cleanup by IT Support
- Scenario: An IT support technician manually clears browser cache and temporary internet files on a user’s workstation to resolve a rendering issue or login loop. This action often involves deleting specific .tmp or cache directories that match the IOCs (e.g., specific file paths or hash values) associated with ClearFake’s persistence or staging mechanisms.
- Filter/Exclusion: Exclude events where the parent process is a known browser executable (e.g., chrome.exe, msedge.exe, firefox.exe) or where the command line contains keywords like --clear-cache, ClearCache, or DeleteTempFiles. Alternatively, exclude if the user account belongs to a service account or IT support group (e.g., IT_Support, Helpdesk_Svc).
Scheduled Disk Cleanup via cleanmgr or PowerShell
- Scenario: A scheduled task or Group Policy preference runs cleanmgr.exe or a PowerShell script (Clear-Item on $env:TEMP or %LOCALAPPDATA%) to free up disk space on domain-joined workstations. If the ClearFake IOCs include specific file hashes or paths in temporary directories, this routine maintenance can trigger the detection.
- Filter/Exclusion: Exclude events where the parent process is cleanmgr.exe or powershell.exe with a command line containing Clear-Item, Remove-Item, or cleanmgr. Additionally, exclude if the scheduled task name matches known maintenance tasks (e.g., DailyDiskCleanup, WeeklyTempClear).
Application-Specific Temporary File Deletion
- Scenario: Enterprise applications like Adobe Creative Suite, Microsoft Office, or Zoom create and delete temporary files in %TEMP% or %APPDATA% during normal operation (e.g., saving a document, ending