ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by monitoring network and endpoint telemetry against a curated set of 50 known Indicators of Compromise (IOCs). Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification of ClearFake artifacts allows the SOC team to rapidly isolate compromised assets before the threat actor can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: ClearFake Total IOCs: 50 IOC Types: domain, url

Type	Value	Threat Type	First Seen	Confidence
domain	ymrtzuano.bio-dantix.com	payload_delivery	2026-08-21	100%
domain	6fkzrm3o.en-en-en-cardioslim.com	payload_delivery	2026-08-21	100%
domain	lejournaldelafinance.com	payload_delivery	2026-08-21	90%
domain	assure360.ch	payload_delivery	2026-08-21	90%
url	hxxps://forecast-chaos.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://sound-obstacle.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://soup-tone.pro/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://seat-aviation.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://root-cherry.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://carpet-sail.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://chief-ignite.pro/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://hair-result.xyz/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://ukwearstore.org	payload_delivery	2026-08-21	90%
url	hxxps://siege-close.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://fashion-chicken.com/n3s9c2a	payload_delivery	2026-08-21	90%
url	hxxps://github.com/CyberKayt/test_rpc/raw/refs/heads/main/driverapi.exe	payload_delivery	2026-08-21	90%
url	hxxps://infodatalis.com	payload_delivery	2026-08-21	90%
url	hxxps://telemetryloop.net	payload_delivery	2026-08-21	90%
domain	en-en-en-cardioslim.com	payload_delivery	2026-08-21	100%
domain	bio-dantix.com	payload_delivery	2026-08-21	100%
domain	ewey5he5.en-cardioslim.us	payload_delivery	2026-08-21	100%
domain	jteqecd8.en-flashbrn.com	payload_delivery	2026-08-21	100%
domain	en-flashbrn.com	payload_delivery	2026-08-21	100%
domain	xlww5gz9.ener--flow.com	payload_delivery	2026-08-21	100%
domain	htbwm97j.en-cardio-slimtea.us	payload_delivery	2026-08-21	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["ymrtzuano.bio-dantix.com", "6fkzrm3o.en-en-en-cardioslim.com", "lejournaldelafinance.com", "assure360.ch", "en-en-en-cardioslim.com", "bio-dantix.com", "ewey5he5.en-cardioslim.us", "jteqecd8.en-flashbrn.com", "en-flashbrn.com", "xlww5gz9.ener--flow.com", "htbwm97j.en-cardio-slimtea.us", "hxzjofuf.en-en-en-blinzador.com", "18ppizar.easybatteryfixed.net", "ener--flow.com", "en-en-en-blinzador.com", "en-cardio-slimtea.us", "easybatteryfixed.net", "o4epigrc.en-en--echofree.com", "en-en--echofree.com", "054bvvua.enerflaw.us", "enerflaw.us", "larosadejerico.es", "eng-brainsong.com", "eng-biobooster.com", "peetg3pz.dentlprime.com", "dentlprime.com", "o2yen35b.en-en--xenburn.com", "en-en--xenburn.com", "manouchy.ch", "b5hhv7o8.crownconnectpk.com", "talos.com.br", "myfitnessbox.be", "eng-aquaburn.us"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://forecast-chaos.com/n3s9c2a", "https://sound-obstacle.com/n3s9c2a", "https://soup-tone.pro/n3s9c2a", "https://seat-aviation.com/n3s9c2a", "https://root-cherry.com/n3s9c2a", "https://carpet-sail.com/n3s9c2a", "https://chief-ignite.pro/n3s9c2a", "https://hair-result.xyz/n3s9c2a", "https://ukwearstore.org", "https://siege-close.com/n3s9c2a", "https://fashion-chicken.com/n3s9c2a", "https://github.com/CyberKayt/test_rpc/raw/refs/heads/main/driverapi.exe", "https://infodatalis.com", "https://telemetryloop.net", "https://cdn.jsdelivr.net/gh/Max-856/crocs/fulls", "https://cdn.jsdelivr.net/gh/Max-856/treem/luda", "https://cdn.jsdelivr.net/gh/roadvillnet/fred/iren"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The security operations team pushes a new policy update containing 50+ threat intelligence indicators (hashes, URLs) to all managed endpoints. This triggers the rule as the system ingests the entire batch of IOCs simultaneously during the deployment window.
  • Filter/Exclusion: Exclude events where the source process is MsMpEng.exe or SenseiService.exe and the event originates from the “Microsoft Defender for Endpoint” management server (e.g., specific FQDNs like *.msecnd.net).

• Scheduled Threat Intelligence Feed Ingestion by CrowdStrike Falcon

  • Scenario: A scheduled job runs every morning at 02:00 UTC to ingest a curated threat feed from a third-party provider. The ingestion process imports exactly 50 IOCs related to the ClearFake campaign, causing the detection logic to fire on the batch import rather than a live threat.
  • Filter/Exclusion: Create an exclusion for events occurring between 01:30 and 02:30 UTC where the Event Source is “Falcon Sensor” and the Action Type indicates “Feed Import” or “Policy Update”.

• Automated Vulnerability Scanning by Tenable Nessus

  • Scenario: The vulnerability management team executes a full-scan job that pulls 50 specific IOCs from a ThreatFox dashboard to cross-reference against current asset vulnerabilities. The scanning engine logs these IOCs as active detections during the scan window.
  • Filter/Exclusion: Filter out events where the Source Host is identified as the Tenable Manager server (e.g., IP