ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against a curated set of 30 Indicators of Compromise (IOCs) specific to the ClearFake malware campaign. Proactively hunting for these IOCs is critical because ClearFake employs sophisticated evasion techniques that often bypass standard signature-based defenses, requiring active threat intelligence integration to identify early-stage infections before lateral movement occurs.

IOC Summary

Malware Family: ClearFake Total IOCs: 30 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	tdsbfjwqc.eng-glycofree.com	payload_delivery	2026-08-23	100%
domain	luzerner-transporte.ch	payload_delivery	2026-08-23	90%
domain	wj2vge4z.eng-usa-neurowave.com	payload_delivery	2026-08-23	100%
domain	eng-usa-neurowave.com	payload_delivery	2026-08-23	100%
domain	p4m4q08g.eng--neurowave.us	payload_delivery	2026-08-23	100%
domain	eng--neurowave.us	payload_delivery	2026-08-23	100%
domain	ch79s29o.eng--nervealive.com	payload_delivery	2026-08-23	100%
domain	8m7qs0tb.eng--glycofree.com	payload_delivery	2026-08-23	100%
domain	eng--nervealive.com	payload_delivery	2026-08-23	100%
domain	eng--glycofree.com	payload_delivery	2026-08-23	100%
domain	unlmqfl5.eng-usa-neurovera.com	payload_delivery	2026-08-23	100%
domain	eng-usa-neurovera.com	payload_delivery	2026-08-23	100%
domain	hashtagshopbd.com	payload_delivery	2026-08-23	90%
domain	growmag.com	payload_delivery	2026-08-23	90%
domain	7ejjnjb6.eng-usa-glycomute.com	payload_delivery	2026-08-23	100%
domain	eng-usa-glycomute.com	payload_delivery	2026-08-23	100%
domain	tnphomes.com	payload_delivery	2026-08-23	90%
domain	textandfonts.com	payload_delivery	2026-08-23	90%
domain	8gmcvfr9.eng-neuro-wave.com	payload_delivery	2026-08-23	100%
domain	eng-neuro-wave.com	payload_delivery	2026-08-23	100%
domain	roland-gisiger.ch	payload_delivery	2026-08-23	90%
domain	salviadivinorumseeds.net	payload_delivery	2026-08-23	90%
domain	5g6unmz0.eng-usa-glycofree.com	payload_delivery	2026-08-23	100%
domain	eng-usa-glycofree.com	payload_delivery	2026-08-23	100%
domain	rs53tvhu.eng--memorylift.com	payload_delivery	2026-08-23	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["tdsbfjwqc.eng-glycofree.com", "luzerner-transporte.ch", "wj2vge4z.eng-usa-neurowave.com", "eng-usa-neurowave.com", "p4m4q08g.eng--neurowave.us", "eng--neurowave.us", "ch79s29o.eng--nervealive.com", "8m7qs0tb.eng--glycofree.com", "eng--nervealive.com", "eng--glycofree.com", "unlmqfl5.eng-usa-neurovera.com", "eng-usa-neurovera.com", "hashtagshopbd.com", "growmag.com", "7ejjnjb6.eng-usa-glycomute.com", "eng-usa-glycomute.com", "tnphomes.com", "textandfonts.com", "8gmcvfr9.eng-neuro-wave.com", "eng-neuro-wave.com", "roland-gisiger.ch", "salviadivinorumseeds.net", "5g6unmz0.eng-usa-glycofree.com", "eng-usa-glycofree.com", "rs53tvhu.eng--memorylift.com", "jd4zow6i.eng--geniusbrainsignal.com", "eng--memorylift.com", "osuna.eu", "intellilab.ch", "laurentgudel.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Threat Intelligence Feed Ingestion by Security Operations Center (SOC)

  • Context: The SOC team utilizes a dedicated ingestion server running Tenable.io or CrowdStrike Falcon Intelligence to pull daily updates from the ClearFake feed. This process generates network traffic and file artifacts matching the 30 IOCs as part of routine enrichment, not an active threat hunt.
  • Filter/Exclusion: Exclude alerts where the source host is a known “SIEM Ingestion Server” (e.g., Host_Name contains SOC-Feed-Ingest) or where the process name matches specific feed parsers like feed_updater.exe. Additionally, filter out events occurring during the scheduled maintenance window (e.g., 02:00–04:00 UTC daily).

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable Nessus

  • Context: During a weekly vulnerability assessment, the Tenable Nessus scanner probes internal assets and resolves external references to ClearFake IOCs to validate asset exposure. The detection logic interprets these scanning artifacts as active threats rather than passive discovery traffic.
  • Filter/Exclusion: Create an exclusion rule for source IP ranges belonging to the vulnerability management infrastructure (e.g., 10.20.50.0/24). Furthermore, filter alerts where the initiating process is identified as nessus.exe or qualyspc.exe, ensuring that scanner-generated IOCs do not trigger incident tickets.

• Scenario: Endpoint Detection and Response (EDR) Policy Updates via Microsoft Defender

  • Context: The enterprise deploys Microsoft Defender for Endpoint with a custom policy