This hypothesis targets the presence of known ClearFake indicators of compromise, which are frequently leveraged by threat actors to establish persistence or execute malicious payloads within Azure environments. Proactively hunting for these IOCs allows the SOC team to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.
Malware Family: ClearFake Total IOCs: 28 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | us-en-us-glycofree.com | payload_delivery | 2026-09-05 | 100% |
| url | hxxps://cdn.jsdelivr.net/gh/frantario/rt8478-4y/pui4410 | payload_delivery | 2026-09-05 | 100% |
| domain | 0vrtpzj3.us-en-us-darkreset.com | payload_delivery | 2026-09-05 | 100% |
| domain | zyevwgux.us-en-us-nervealive.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-nervealive.com | payload_delivery | 2026-09-05 | 100% |
| domain | 96e0qwgn.hero--up.com | payload_delivery | 2026-09-05 | 100% |
| domain | fppgncn7.us-en-us-biobooster.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-biobooster.com | payload_delivery | 2026-09-05 | 100% |
| domain | c9xrdjdb.us-en-us-enerflow.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-enerflow.com | payload_delivery | 2026-09-05 | 100% |
| domain | 465p7p53.usen-synadentix.com | payload_delivery | 2026-09-05 | 100% |
| domain | zijopublishing.com | payload_delivery | 2026-09-05 | 90% |
| domain | eamznepn.us-en-us-morningcoffeeritual.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-morningcoffeeritual.com | payload_delivery | 2026-09-05 | 100% |
| domain | kj4t0j98.us-en-us-xenburn.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-xenburn.com | payload_delivery | 2026-09-05 | 100% |
| domain | 18ttucts.us-en-us-eloncode.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-eloncode.com | payload_delivery | 2026-09-05 | 100% |
| url | hxxps://cdn.jsdelivr.net/gh/frantario/rtr57-44/afa1194 | payload_delivery | 2026-09-05 | 100% |
| domain | e2u8o9ap.us-en-us-levium.com | payload_delivery | 2026-09-05 | 100% |
| domain | us-en-us-levium.com | payload_delivery | 2026-09-05 | 100% |
| domain | translate.google.com | payload_delivery | 2026-09-04 | 100% |
| domain | rxsvjmwu.us-en-us-theeloncode.com | payload_delivery | 2026-09-04 | 100% |
| domain | us-en-us-theeloncode.com | payload_delivery | 2026-09-04 | 100% |
| domain | 66gpqygz.us-en-us-darkreset.com | payload_delivery | 2026-09-04 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["us-en-us-glycofree.com", "0vrtpzj3.us-en-us-darkreset.com", "zyevwgux.us-en-us-nervealive.com", "us-en-us-nervealive.com", "96e0qwgn.hero--up.com", "fppgncn7.us-en-us-biobooster.com", "us-en-us-biobooster.com", "c9xrdjdb.us-en-us-enerflow.com", "us-en-us-enerflow.com", "465p7p53.usen-synadentix.com", "zijopublishing.com", "eamznepn.us-en-us-morningcoffeeritual.com", "us-en-us-morningcoffeeritual.com", "kj4t0j98.us-en-us-xenburn.com", "us-en-us-xenburn.com", "18ttucts.us-en-us-eloncode.com", "us-en-us-eloncode.com", "e2u8o9ap.us-en-us-levium.com", "us-en-us-levium.com", "translate.google.com", "rxsvjmwu.us-en-us-theeloncode.com", "us-en-us-theeloncode.com", "66gpqygz.us-en-us-darkreset.com", "us-en-us-darkreset.com", "q118vn58.hero--up.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/frantario/rt8478-4y/pui4410", "https://cdn.jsdelivr.net/gh/frantario/rtr57-44/afa1194", "https://cdn.jsdelivr.net/gh/cowenrty/issue/ggl"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
yara.exe, volatility3, falconctl) or where the file path contains /tmp/, /var/tmp/, or \\security\analysis\.PowerShell or Batch to patch endpoints, and the script temporarily downloads or stages the ClearFake IOC list (e.g., clearfake_iocs.txt) in the user’s %TEMP% or C:\Windows\Temp directory for comparison against current endpoint states.
powershell.exe or cmd.exe and the command line arguments contain keywords like update, patch, compare, or verify.environment=staging, environment=test, or role=qa in the CMDB or asset inventory, or exclude paths under C:\QA\ or D:\TestEnvs\.