This hunt targets adversary activity involving the specific set of 36 Indicators of Compromise (IOCs) linked to the ClearFake malware campaign. Proactively searching for these indicators in Azure Sentinel is critical because early detection allows the SOC team to identify and contain potential infections before they escalate into widespread data exfiltration or lateral movement events.
Malware Family: ClearFake Total IOCs: 36 IOC Types: sha256_hash, url, ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | kdf.betbacklink.com | payload_delivery | 2026-06-30 | 100% |
| domain | i5sofk6r.xbetone.com | payload_delivery | 2026-06-30 | 100% |
| domain | imohoo.com.br | payload_delivery | 2026-06-30 | 90% |
| domain | unspanel.rs | payload_delivery | 2026-06-30 | 90% |
| domain | fearlesshomemaker.com | payload_delivery | 2026-06-30 | 90% |
| domain | keypharmacy.uk | payload_delivery | 2026-06-30 | 90% |
| domain | lifetimeeyecare.biz | payload_delivery | 2026-06-30 | 90% |
| domain | ajantaappliances.com | payload_delivery | 2026-06-30 | 90% |
| domain | thekiss.gr | payload_delivery | 2026-06-30 | 90% |
| domain | swanriverschool.org | payload_delivery | 2026-06-30 | 90% |
| domain | dainikkishoreganj.com | payload_delivery | 2026-06-30 | 90% |
| domain | alpin-tuning.com | payload_delivery | 2026-06-30 | 90% |
| domain | tools4teens.net | payload_delivery | 2026-06-30 | 90% |
| domain | phcnepal.com | payload_delivery | 2026-06-30 | 90% |
| domain | cakramakmurabadi.com | payload_delivery | 2026-06-30 | 90% |
| domain | insideautomacao.com.br | payload_delivery | 2026-06-30 | 90% |
| domain | hashsolution.com | payload_delivery | 2026-06-30 | 90% |
| domain | m-und-c-partners.de | payload_delivery | 2026-06-30 | 90% |
| domain | knowmat.com | payload_delivery | 2026-06-30 | 90% |
| domain | vihangamyoga.org | payload_delivery | 2026-06-30 | 90% |
| domain | lisanslab.com | payload_delivery | 2026-06-30 | 90% |
| sha256_hash | ce29b8c2576712a33aae06aee02486440c9268fcc19da1496a074feeee0a5178 | payload | 2026-06-30 | 90% |
| url | hxxps://eb0ca005.verifying-your-identity-proceedv1.pages.dev/?x=j7b5cr22&y=1782755817438&z=425693 | payload_delivery | 2026-06-30 | 100% |
| domain | 46imdg6k.blackjackonlineplay83.com | payload_delivery | 2026-06-30 | 100% |
| domain | 328bpzpg[.]313betapk.com | payload_delivery | 2026-06-30 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ClearFake
let malicious_ips = dynamic(["193.233.82.126"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.233.82.126"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["kdf.betbacklink.com", "i5sofk6r.xbetone.com", "imohoo.com.br", "unspanel.rs", "fearlesshomemaker.com", "keypharmacy.uk", "lifetimeeyecare.biz", "ajantaappliances.com", "thekiss.gr", "swanriverschool.org", "dainikkishoreganj.com", "alpin-tuning.com", "tools4teens.net", "phcnepal.com", "cakramakmurabadi.com", "insideautomacao.com.br", "hashsolution.com", "m-und-c-partners.de", "knowmat.com", "vihangamyoga.org", "lisanslab.com", "46imdg6k.blackjackonlineplay83.com", "328bpzpg.313betapk.com", "uhv95fx8.betbuf.live", "0dahrppq.taktikbet.bio", "r32rtlhu.1xbetpartnersiran.com", "moderncloudprotection.com", "publicwebprotection.com", "superfirewallprotection.com", "r4zhwkgz.betbuf.live", "zenithharbinger.digital", "radiantprospera.digital", "latticepatronage.digital"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://eb0ca005.verifying-your-identity-proceedv1.pages.dev/?x=j7b5cr22&y=1782755817438&z=425693"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - ClearFake
let malicious_hashes = dynamic(["ce29b8c2576712a33aae06aee02486440c9268fcc19da1496a074feeee0a5178"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:
Endpoint Security Patch Deployment via SCCM/Intune
Process Name (e.g., ccmexec.exe, MicrosoftEdgeUpdate.exe) combined with a specific User Account range (e.g., DOMAIN\svc-sc-cm-*). Additionally, exclude events occurring during the defined maintenance window (e.g., Sundays 02:00–04:00 UTC).Automated Vulnerability Scanning by Qualys or Tenable
Parent Process is known scanning agents (e.g., qualyspc.exe, tenable_agent.exe) or exclude specific source IP addresses belonging to the vulnerability management infrastructure subnet (e.g., 10.20.30.0/24).IT Admin Manual Remediation of a Known False Positive