This hunt hypothesis targets adversary behavior where malicious actors leverage ClearFake infrastructure to deploy known indicators of compromise (IOCs) within the network environment. Proactively hunting these specific 103 IOCs in Azure Sentinel is critical for early detection and containment of high-severity threats before they can establish persistence or exfiltrate sensitive data.
Malware Family: ClearFake Total IOCs: 103 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | fgkz[.]1pishbini.com | payload_delivery | 2026-07-10 | 100% |
| domain | bizec8bu.zaribbala.bet | payload_delivery | 2026-07-10 | 100% |
| domain | o9a66qig.zaribbala.bet | payload_delivery | 2026-07-10 | 100% |
| domain | ohnymfxm.btyek.cloud | payload_delivery | 2026-07-10 | 100% |
| domain | eosgdskc.btyek.site | payload_delivery | 2026-07-10 | 100% |
| domain | mbzomqnr.btyek.site | payload_delivery | 2026-07-10 | 100% |
| domain | ydmotena.bunos.bet | payload_delivery | 2026-07-10 | 100% |
| domain | mvyj.radioshartbandi.blog | payload_delivery | 2026-07-10 | 100% |
| domain | radioshartbandi.blog | payload_delivery | 2026-07-10 | 100% |
| domain | huzlrwhe.btyek.cloud | payload_delivery | 2026-07-10 | 100% |
| domain | vacnkjqi.btyek.cloud | payload_delivery | 2026-07-10 | 100% |
| domain | wlmulfgg.mellbeet.com | payload_delivery | 2026-07-10 | 100% |
| domain | lyrp.radioshartbandi.bet | payload_delivery | 2026-07-10 | 100% |
| domain | oria.radioshartbandi.bet | payload_delivery | 2026-07-10 | 100% |
| domain | x53ini6v.winnerbaz.bet | payload_delivery | 2026-07-10 | 100% |
| domain | aonwiltw.irantop.bet | payload_delivery | 2026-07-10 | 100% |
| domain | huy9e25g.winnerbaz.bet | payload_delivery | 2026-07-10 | 100% |
| domain | ddsmolcn.irantop.bet | payload_delivery | 2026-07-10 | 100% |
| domain | kzdccycs.irantop.bet | payload_delivery | 2026-07-10 | 100% |
| domain | gjuqzxwz.irantop.bet | payload_delivery | 2026-07-10 | 100% |
| domain | tdfdekwf.hazzaratbet.com | payload_delivery | 2026-07-10 | 100% |
| domain | base4openwald.dexispointnexus.garden | botnet_cc | 2026-07-10 | 90% |
| domain | abkp.site-shartbandi-khareji.com | payload_delivery | 2026-07-10 | 100% |
| domain | sxewurs5.radioshartbandi.com | payload_delivery | 2026-07-10 | 100% |
| domain | hn8ah9qr.pdfteach.ir | payload_delivery | 2026-07-10 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["fgkz.1pishbini.com", "bizec8bu.zaribbala.bet", "o9a66qig.zaribbala.bet", "ohnymfxm.btyek.cloud", "eosgdskc.btyek.site", "mbzomqnr.btyek.site", "ydmotena.bunos.bet", "mvyj.radioshartbandi.blog", "radioshartbandi.blog", "huzlrwhe.btyek.cloud", "vacnkjqi.btyek.cloud", "wlmulfgg.mellbeet.com", "lyrp.radioshartbandi.bet", "oria.radioshartbandi.bet", "x53ini6v.winnerbaz.bet", "aonwiltw.irantop.bet", "huy9e25g.winnerbaz.bet", "ddsmolcn.irantop.bet", "kzdccycs.irantop.bet", "gjuqzxwz.irantop.bet", "tdfdekwf.hazzaratbet.com", "base4openwald.dexispointnexus.garden", "abkp.site-shartbandi-khareji.com", "sxewurs5.radioshartbandi.com", "hn8ah9qr.pdfteach.ir", "radioshartbandi.com", "pdfteach.ir", "tjxoublo.fileboroo.com", "vsdspmqv.fileboroo.com", "fd.gstats-api-contact.cc", "islandepstain.cc", "gamorarar.cc", "pkg.vogueatelier.cc", "solid-manage.com", "tikcettoread.com", "kqbnjbmm.bunos.bet", "meba.sib90.bet", "sib90.bet", "authorization-press-enter.info", "m5wftmcs.vip1xbet.xyz", "ke2odk7l.vip1xbet.xyz", "lquhgnrw.studypersia.ir", "fguhhncc.studypersia.ir", "studypersia.ir", "yhlv.shartbandi.video", "shartbandi.video", "zbmcuemc.sporttraining.ir", "uummkhfb.sporttraining.ir", "jvdf.serial.video", "serial.video"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:
Endpoint Protection Policy Updates via Microsoft Defender for Endpoint (MDE)
Source IP or Process Name. Filter out events where the initiating process is MsMpEng.exe (Windows Defender) or Sense.exe (CrowdStrike, if applicable) originating from internal management subnets (e.g., 10.20.x.x) during standard maintenance windows (e.g., 02:00–04:00 UTC).Automated Threat Intelligence Feed Ingestion by Splunk Enterprise Security
clearfake_ioc_lookup), it generates a high-volume alert for each of the 103 IOCs as they are indexed and cross-referenced against existing logs.Event Type. Exclude alerts where the event source is identified as siem_ingestion_job or threat_feed_sync rather than endpoint_detection. Additionally, suppress alerts if the Action field indicates “Lookup Update” or “Indexing” rather than “Malware Detection.”**Scheduled Vulnerability Scanning with