ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of nine specific IOCs linked to the ClearFake malware family, which are commonly used to establish initial access or execute malicious payloads within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of persistent threats before they can escalate to lateral movement or data exfiltration.

IOC Summary

Malware Family: ClearFake Total IOCs: 9 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["gsawilc2.morgz.store", "jpfl8cwa.kapkan.store", "5jtpv8ur.planus.store", "xn--glckauf-gmbh-elb.de", "kttjcvdz.ddkg.store", "h8rpbqpa.damza.store", "catechese.ch", "cyrille-camping-car.fr", "qirsjdwk.kamaks.store"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A DevOps engineer deploys a new microservice container using a public base image that includes the clearfake utility for testing network transparency features, or a CI/CD pipeline (e.g., Jenkins, GitLab CI) executes a build step that downloads and runs the clearfake binary to validate proxy configurations.

  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins-agent, gitlab-runner, drone-runner) or where the executable path resides within standard build artifact directories (e.g., /opt/ci/bin/, /tmp/builds/).

• Scenario: An application security team uses clearfake as part of a manual penetration test or chaos engineering exercise to simulate traffic obfuscation, running the tool from a dedicated test user account or a specific test host with a known IP range.

  • Filter/Exclusion: Exclude events where the user account belongs to a security group named “PenTest” or “ChaosEng”, or where the source IP address falls within the designated test subnet (e.g., 10.20.0.0/24).

• Scenario: A legacy internal tool or custom script developed by the engineering team bundles the clearfake binary into a monolithic application installer or a specific utility package (e.g., net-utils-v2.zip) that is deployed to multiple servers for routine network diagnostics.

  • Filter/Exclusion: Exclude processes where the executable name is clearfake but the parent process is a known internal wrapper script (e.g., run-diagnostics.sh, net-check.exe) or where the file hash matches a known-good internal build artifact registered in the asset inventory.

• Scenario: A developer installs clearfake via a package manager (e.g., `apt