ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hypothesis targets the presence of ClearFake indicators, a high-severity threat often associated with advanced phishing or malware campaigns, to identify compromised assets before lateral movement occurs. Proactively hunting these IOCs in Azure Sentinel allows the SOC team to correlate network and endpoint telemetry, ensuring rapid isolation of affected systems and reducing the dwell time of this specific threat actor.

IOC Summary

Malware Family: ClearFake Total IOCs: 10 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["2tkoflhf.berlin-knights.com", "berlin-knights.com", "capsurlavenir.com", "dwzc4sh2.comsift.com", "comsift.com", "pbqftjpa.computer-warehouse-too.com", "computer-warehouse-too.com", "861rhd3p.gharoga.com", "jndlj3g6.us-thetrumptoken.com", "ho5k07c2.web-enerflow.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a new version of a web application that includes a legitimate JavaScript library or asset hash matching one of the ClearFake IOCs. The deployment script runs on a build agent or a specific application server, triggering the IOC match during the file write or process execution phase.

  • Filter/Exclusion: Exclude processes initiated by known CI/CD service accounts (e.g., svc-github-actions, jenkins-agent) or specific build directories (e.g., C:\builds\, /var/lib/jenkins/workspace/). Additionally, whitelist the specific executable names associated with the deployment tools (e.g., node.exe, python.exe) when running from these known paths.

• Scenario: An IT administrator performs a routine patching or software update using a tool like SCCM (System Center Configuration Manager) or PDQ Deploy. The installer for a third-party application (e.g., a browser plugin or SDK) contains a binary or configuration file with a hash or path pattern that overlaps with a ClearFake IOC, often because the IOC is based on a generic filename or a common library used by multiple vendors.

  • Filter/Exclusion: Exclude events where the parent process is a known deployment agent (e.g., ccmexec.exe, pdqdeploy.exe) or where the action is explicitly tagged as “Software Deployment” in the event metadata. Consider excluding specific installer executables (e.g., msiexec.exe, setup.exe) when they are launched by the deployment service account.

• Scenario: A security team runs a scheduled vulnerability scan or integrity check using tools like Nessus, Qualys, or OpenSCAP. These tools often execute probe scripts or small binaries to test system configurations, which may reside in temporary directories or have filenames that match the IOCs