ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the ClearFake campaign, which is known for deploying sophisticated malware and phishing operations. A SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections or lateral movement attempts that may have bypassed standard automated detection rules.

IOC Summary

Malware Family: ClearFake Total IOCs: 15 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["tagsmarketing.com", "thewelchstreetjournal.com", "tragroup.co.za", "edamame-sushi.ch", "22nbxu1y.eng-usa-goldalign.com", "2evjlhkn.app8k.xyz", "slotcash.site", "atanackovic.ch", "burnpeak.us.com", "burnpeakofficialsite.com", "pedzes.ch", "golfmontreux.ch", "ametiqbanking.ch", "imroos.ch", "j7sd6wjs.en-theslimsplitsmethod.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Legitimate Antivirus Definition Updates: Enterprise endpoints running CrowdStrike Falcon or Microsoft Defender for Endpoint frequently pull definition updates from the vendor’s cloud repository. These updates often contain hash signatures and network destinations that match ClearFake IOCs, triggering alerts when the AV service communicates with update servers during scheduled maintenance windows (e.g., nightly at 02:00 UTC).

  • Suggested Filter: Exclude traffic originating from the specific IP ranges of the antivirus vendor’s update servers or filter events where the process name matches known AV services (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or MsMpEng.exe) and the action is “Update” or “Scan”.

• Scheduled Backup and Data Archiving Jobs: Automated backup solutions like Veeam Backup & Replication or Rubrik often utilize cloud storage repositories that may share infrastructure or network paths with ClearFake. When these jobs execute (typically via Windows Task Scheduler or cron), they generate large volumes of outbound traffic to specific IP addresses and file hashes that overlap with the detection rule’s IOCs.

  • Suggested Filter: Create an exclusion for processes running under the context of backup services (e.g., Veeam.Backup.Service.exe, rubrik-agent) during their defined maintenance windows, or whitelist the destination IPs known to be part of the organization’s primary cloud storage provider.

• Software Deployment and Patching Operations: IT administrators using tools like Microsoft Endpoint Configuration Manager (MECM) or Ivanti Neurons push software patches and application installations across the fleet. These deployment agents often download packages from distribution points that utilize ClearFake-associated IOCs, particularly when distributing security tool updates or third-party applications.

  • Suggested Filter: Implement a rule to suppress alerts for traffic generated by known deployment agent processes (