ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake malware campaign by identifying matches against a curated set of 20 specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical due to the high severity of ClearFake’s potential impact on endpoint integrity and data exfiltration capabilities.

IOC Summary

Malware Family: ClearFake Total IOCs: 20 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	3pynvhuk.ultralightlondon.uk	payload_delivery	2026-08-30	100%
domain	ultralightlondon.uk	payload_delivery	2026-08-30	100%
domain	1jtxup9c.pura--boost.us	payload_delivery	2026-08-30	100%
domain	pura--boost.us	payload_delivery	2026-08-30	100%
domain	uehky4jw.prosta--fense.com	payload_delivery	2026-08-30	100%
domain	xy08z5pm.shop-aizenpower.us	payload_delivery	2026-08-30	100%
domain	shop-aizenpower.us	payload_delivery	2026-08-30	100%
domain	log.afghankabobgrill.com	botnet_cc	2026-08-30	100%
domain	quy30mlr.shop-aeroslim.us	payload_delivery	2026-08-30	100%
domain	shop-aeroslim.us	payload_delivery	2026-08-30	100%
domain	s0bhultx.thirtyonehat.net	payload_delivery	2026-08-30	100%
domain	boyenspray.arrow-it.dev	payload_delivery	2026-08-30	90%
domain	76fz7fl1.thegvgalleryco.com	payload_delivery	2026-08-30	100%
domain	log.afghankabobgrill.com	payload_delivery	2026-08-30	90%
domain	thegvgalleryco.com	payload_delivery	2026-08-30	100%
domain	raspberryhillsshop.com	payload_delivery	2026-08-30	100%
domain	jbyn0h7d.shop-abundancegoddess.us	payload_delivery	2026-08-30	100%
domain	shop-abundancegoddess.us	payload_delivery	2026-08-30	100%
domain	rm9jpaae.themertraa.com	payload_delivery	2026-08-30	100%
domain	themertraa.com	payload_delivery	2026-08-30	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["3pynvhuk.ultralightlondon.uk", "ultralightlondon.uk", "1jtxup9c.pura--boost.us", "pura--boost.us", "uehky4jw.prosta--fense.com", "xy08z5pm.shop-aizenpower.us", "shop-aizenpower.us", "log.afghankabobgrill.com", "quy30mlr.shop-aeroslim.us", "shop-aeroslim.us", "s0bhultx.thirtyonehat.net", "boyenspray.arrow-it.dev", "76fz7fl1.thegvgalleryco.com", "log.afghankabobgrill.com", "thegvgalleryco.com", "raspberryhillsshop.com", "jbyn0h7d.shop-abundancegoddess.us", "shop-abundancegoddess.us", "rm9jpaae.themertraa.com", "themertraa.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, tailored for an enterprise environment:

• Scenario 1: Automated Threat Intelligence Feed Ingestion by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint automatically ingest global threat intelligence feeds. These agents frequently download the “ClearFake” IOC package to update their local detection engines, triggering network connections to the ThreatFox distribution servers.
  • Suggested Filter/Exclusion: Create a rule exclusion based on the specific process names of the EDR agent services (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\Windows\System32\MsMpEng.exe) when communicating with known ThreatFox distribution IP ranges.

• Scenario 2: Scheduled SIEM Correlation Engine Updates

  • Context: The organization’s Security Information and Event Management (SIEM) platform, such as Splunk Enterprise Security or IBM QRadar, runs a nightly scheduled job to pull the latest ClearFake IOC package via an API connector. This process generates network traffic matching the detection logic during maintenance windows (e.g., 02:00 – 04:00 UTC).
  • Suggested Filter/Exclusion: Implement a time-based exclusion window for alerts generated by the SIEM’s ingestion service account (e.g., svc-siem-ingest) between 01:30 and 05:00 daily, or filter out traffic originating from the dedicated DMZ server hosting the SIEM collectors.

• Scenario 3: Security Analyst Manual IOC Validation via Threat Intelligence Platform

  • Context: During routine threat hunting exercises, analysts manually query the ThreatFox