This detection rule identifies adversary activity by correlating network and endpoint telemetry against a curated set of 59 Indicators of Compromise (IOCs) specific to the ClearFake malware campaign. Proactively hunting for these IOCs within Azure Sentinel is critical because ClearFake employs sophisticated evasion techniques that often bypass standard signature-based defenses, requiring active investigation to prevent potential data exfiltration and lateral movement.
Malware Family: ClearFake Total IOCs: 59 IOC Types: domain, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | xn5nkp1j.us-energyrevolution.com | payload_delivery | 2026-08-16 | 100% |
| domain | cvxxvcasdqehgfjg.icu | botnet_cc | 2026-08-16 | 90% |
| domain | el-5fmkdhfsfdsg.digital | botnet_cc | 2026-08-16 | 90% |
| domain | ka4yxanb.andliberty.us | payload_delivery | 2026-08-16 | 100% |
| domain | andliberty.us | payload_delivery | 2026-08-16 | 100% |
| domain | elliptical-rabbit.icu | botnet_cc | 2026-08-16 | 90% |
| domain | augenzentrum-willisau.ch | payload_delivery | 2026-08-16 | 90% |
| sha256_hash | aefaa46082749a5d322ccada8e12edec3c24e34777db26865d1f357749261e6c | payload | 2026-08-16 | 90% |
| domain | vereinsheim-noerdli.ch | payload_delivery | 2026-08-16 | 90% |
| domain | magellan-ms.com | payload_delivery | 2026-08-16 | 90% |
| domain | gerhard-trede.com | payload_delivery | 2026-08-16 | 90% |
| domain | oczzvkdm.americaneaglependant.us | payload_delivery | 2026-08-16 | 100% |
| domain | americaneaglependant.us | payload_delivery | 2026-08-16 | 100% |
| domain | mdckuwait.com | payload_delivery | 2026-08-16 | 90% |
| domain | marco-elling.de | payload_delivery | 2026-08-16 | 90% |
| domain | z8l6eurt.gtacauto.com | payload_delivery | 2026-08-16 | 100% |
| domain | 2bqvf65p.usa-us--goldalign.com | payload_delivery | 2026-08-16 | 100% |
| domain | hempartindonesia.com | payload_delivery | 2026-08-16 | 90% |
| domain | kinderpsycholooghetgooi.nl | payload_delivery | 2026-08-16 | 90% |
| domain | kilimanjaromavens.com | payload_delivery | 2026-08-16 | 90% |
| domain | jh-athletics.de | payload_delivery | 2026-08-16 | 90% |
| domain | ladaco.net | payload_delivery | 2026-08-16 | 90% |
| domain | kreiles-kreativwerkstatt.de | payload_delivery | 2026-08-16 | 90% |
| domain | juristice.com | payload_delivery | 2026-08-16 | 90% |
| domain | p4wao0pc.americaneaglependant.net | payload_delivery | 2026-08-16 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["xn5nkp1j.us-energyrevolution.com", "cvxxvcasdqehgfjg.icu", "el-5fmkdhfsfdsg.digital", "ka4yxanb.andliberty.us", "andliberty.us", "elliptical-rabbit.icu", "augenzentrum-willisau.ch", "vereinsheim-noerdli.ch", "magellan-ms.com", "gerhard-trede.com", "oczzvkdm.americaneaglependant.us", "americaneaglependant.us", "mdckuwait.com", "marco-elling.de", "z8l6eurt.gtacauto.com", "2bqvf65p.usa-us--goldalign.com", "hempartindonesia.com", "kinderpsycholooghetgooi.nl", "kilimanjaromavens.com", "jh-athletics.de", "ladaco.net", "kreiles-kreativwerkstatt.de", "juristice.com", "p4wao0pc.americaneaglependant.net", "americaneaglependant.net", "51jt9qzn.us-en-us-neuroxen.com", "garagemattmueller.ch", "brandlet.ch", "docs4apps.com", "eyupsultanveteriner.com", "bvhqwydv.greenestreetchurch.com", "cwagencies.london", "ddukerealtor.com", "colombacresco.com", "0w4jy1j1.usa-slimsounds.com", "bilderrahmen-bleile.de", "auto-sewing.com", "vivensa.ch", "axoralighting.com", "kv73gaf5.get-goldalign.com", "2zslmvx8.theslimsplitsmethod.us", "hmwtez6m.getbraindefender.us", "jcagence.com", "7cz5jg6k.enus-goldalign.com", "rilzg1u6.shop-sightfresh.com", "dt6wrsv7.en-usa-sightfresh.com", "learning-objects.ch", "1e2wdyj0.eng-usa-goldalign.com", "sessionx.net", "bxb41a9q.federationofpbos.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - ClearFake
let malicious_hashes = dynamic(["aefaa46082749a5d322ccada8e12edec3c24e34777db26865d1f357749261e6c", "6cad154538301583429bf7ebe03f812afa33e4d2207ce54b2e488f3cc74e4eba", "b199f70d109357f81c2f147318b424d91fd635449b19c9610f50e428a0c68e8e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:
Scenario: The Security Operations Center (SOC) team manually imports a batch of threat intelligence feeds from a third-party vendor (e.g., Recorded Future or Anomali ThreatStream) into their SIEM. This import process triggers the ingestion of 59 distinct IOCs (IPs, hashes, and domains) that match the ClearFake signature set, causing an alert even though these are known benign indicators used for enrichment.
source_user or process_name. Exclude alerts where the source process is the SIEM ingestion service (e.g., SplunkForwarder.exe, Elastic-Logstash) and the user context is the dedicated service account (e.g., svc_threat_intel).Scenario: The IT Operations team runs a scheduled nightly job using Microsoft System Center Configuration Manager (SCCM) to deploy updated antivirus definitions or patch management scripts. This deployment package includes a manifest containing 59 specific file hashes and network endpoints that overlap with the ClearFake IOC list, triggering the rule during the maintenance window between 02:00 and 04:00 AM.
ccmexec.exe) occurring within the defined maintenance window (e.g., TimeOfDay BETWEEN '02:00' AND '04:00').Scenario: The Enterprise Security team utilizes a cloud-native sandboxing solution, such as Palo Alto Networks Cortex XSOAR or Microsoft Defender for Cloud Apps, to perform automated malware analysis on new downloads. When the sandbox executes a test suite against a specific software update,