This hunt detects adversary activity by correlating Azure Sentinel logs against 21 specific Indicators of Compromise (IOCs) linked to the ClearFake malware family. Proactive hunting for these IOCs is critical to identify early-stage infections and mitigate potential data exfiltration or lateral movement before the threat escalates within the environment.
Malware Family: ClearFake Total IOCs: 21 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | eskacangtvri.com | payload_delivery | 2026-08-20 | 100% |
| domain | freedomfamiliesfoundation.org | botnet_cc | 2026-08-20 | 90% |
| domain | bulan77.online | payload_delivery | 2026-08-20 | 100% |
| domain | yoasistente.com | payload_delivery | 2026-08-20 | 100% |
| domain | 88hma9a9.gtacauto.com | payload_delivery | 2026-08-20 | 100% |
| domain | 51amiyqh.biodenttix.us | payload_delivery | 2026-08-20 | 100% |
| domain | biodenttix.us | payload_delivery | 2026-08-20 | 100% |
| domain | fibre-industries.de | payload_delivery | 2026-08-20 | 90% |
| domain | freedomfamiliesfoundation.org | payload_delivery | 2026-08-20 | 90% |
| domain | iu2oga69.eng-usa-goldalign.com | payload_delivery | 2026-08-20 | 100% |
| domain | waeschereileo.ch | payload_delivery | 2026-08-20 | 90% |
| domain | magazine50plus.ch | payload_delivery | 2026-08-20 | 90% |
| domain | fokus-schweiz.ch | payload_delivery | 2026-08-20 | 90% |
| domain | diyt2xb5.blooddarmor.com | payload_delivery | 2026-08-20 | 100% |
| domain | blooddarmor.com | payload_delivery | 2026-08-20 | 100% |
| domain | augenzentrum-huttwil.ch | payload_delivery | 2026-08-20 | 90% |
| domain | niort-boissons.fr | payload_delivery | 2026-08-20 | 90% |
| domain | maurotacchella.ch | payload_delivery | 2026-08-20 | 90% |
| domain | kalozia.fr | payload_delivery | 2026-08-20 | 90% |
| domain | credipaas.com | payload_delivery | 2026-08-20 | 100% |
| domain | wt1d3ceb.en-en-en-slimsounds.com | payload_delivery | 2026-08-20 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["eskacangtvri.com", "freedomfamiliesfoundation.org", "bulan77.online", "yoasistente.com", "88hma9a9.gtacauto.com", "51amiyqh.biodenttix.us", "biodenttix.us", "fibre-industries.de", "freedomfamiliesfoundation.org", "iu2oga69.eng-usa-goldalign.com", "waeschereileo.ch", "magazine50plus.ch", "fokus-schweiz.ch", "diyt2xb5.blooddarmor.com", "blooddarmor.com", "augenzentrum-huttwil.ch", "niort-boissons.fr", "maurotacchella.ch", "kalozia.fr", "credipaas.com", "wt1d3ceb.en-en-en-slimsounds.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:
Security Team Manual Threat Hunting: Security analysts often manually pull threat intelligence feeds or run custom scripts to validate new IOCs against internal assets. When a threat hunter executes a PowerShell script or uses a tool like PowerShell or Python to query the ClearFake package, it generates network traffic matching the rule’s 21 IOCs.
powershell.exe or python.exe and the user context belongs to the “SOC-Admins” or “Threat-Hunters” Active Directory group.Scheduled Vulnerability Management Scans: Enterprise vulnerability scanners, such as Tenable Nessus or Qualys, frequently include ClearFake IOCs in their baseline libraries to check for known malicious indicators during nightly scans. The scanner’s agent communicating with the central management server triggers these detections.
10.20.5.0/24) or filter out events where the process name contains “Nessus” or “Qualys”.Endpoint Protection Policy Updates: Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint often push updated detection policies that include ClearFake signatures. During a scheduled policy refresh, the EDR agent updates its local IOC database, generating traffic that mimics an active threat match.
svc-crowdstrike or MDE-UpdateService) during standard maintenance windows (e.g., 02:00–