ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the ClearFake campaign, which is known for deploying sophisticated fake antivirus tools to establish persistence and exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into full-scale compromises, ensuring rapid containment of this high-severity threat vector.

IOC Summary

Malware Family: ClearFake Total IOCs: 10 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["oionthzfg.en-us-morningfatmelter.com", "oz42q2a3.get-aquaburn.com", "get-aquaburn.com", "taschenmitdruck.de", "en-us-nurvealive.com", "laserimb.ch", "w0unb44m.geniusbrainsignal.us", "geniusbrainsignal.us", "eldertechsupport.com", "pig.369bbqsifangonline.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

False Positive Scenarios for “ThreatFox: ClearFake IOCs” Detection Rule

• Scheduled Antivirus Definition Updates

  • Scenario: The enterprise endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) automatically downloads and installs new definition packs. These updates often include hash signatures or certificate chains that match the specific 10 IOCs associated with ClearFake, triggering a detection during the nightly maintenance window.
  • Filter/Exclusion: Exclude alerts where the Process Name matches known AV update services (e.g., mpcmdrun.exe, CrowdStrikeService.exe) and the User Account is a dedicated service account (e.g., AV-Update-Svc). Additionally, filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 local time).

• Software Deployment via Configuration Management Tools

  • Scenario: The IT team utilizes tools like Microsoft SCCM or Ansible to push a new application package containing ClearFake-related libraries or dependencies. During the deployment phase, the installation process generates network traffic and file hashes that align with the rule’s IOCs as part of legitimate software provisioning.
  • Filter/Exclusion: Create an exclusion for alerts where the Source IP belongs to the internal Configuration Management Server subnet (e.g., 10.50.20.x) or where the Parent Process Name is a known deployment agent (e.g., ccmsetup.exe, ansible-runner).

• Automated Backup and Archiving Jobs

  • Scenario: Enterprise backup solutions such as Veeam or Commvault perform scheduled backups of critical data repositories. These jobs often process large volumes of files, including those with ClearFake signatures embedded in the archive metadata or container formats, causing the detection logic to flag them as potential IOCs.