ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by identifying indicators of compromise such as malicious domains and file hashes that signal potential data exfiltration or initial access attempts. Proactively hunting for these IOCs in Azure Sentinel is critical because ClearFake employs sophisticated evasion techniques, requiring early detection to prevent lateral movement and minimize impact on sensitive enterprise assets.

IOC Summary

Malware Family: ClearFake Total IOCs: 12 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["intratechsa.co.za", "kap-engineering.co.uk", "r339jk17.mertre.net", "vyw0demm.gluccotrust--bites.com", "conectao.com.do", "dpiwraps.com", "gebbxexd.shop-alphaboostpro.us", "consultinggetdsm.com", "441k40w4.shop-bellyflush.com", "shop-bellyflush.com", "wdccb3xe.home-power-shield.com", "prgfeg84.getdsm.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario 1: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running CrowdStrike Falcon or Microsoft Defender for Endpoint often trigger network connections to known update servers that match ClearFake IOCs during their nightly definition sync windows. These legitimate updates may share IP ranges or hash signatures with the threat intelligence feed.
  • Suggested Filter/Exclusion: Create a time-based exclusion allowing traffic from these specific endpoints between 02:00 and 04:00 UTC, provided the destination port is restricted to standard update ports (e.g., TCP 80, 443) and the process name matches C:\Program Files\CrowdStrike\FalconSensor.exe or MsMpEng.exe.

• Scenario 2: Third-Party Cloud Backup Agents

  • Context: Automated backup agents such as Veeam Backup & Replication or Rubrik frequently initiate outbound connections to cloud storage gateways. If the ClearFake IOC list includes IPs used by these vendors’ regional gateways, the rule will flag routine backup jobs (e.g., vbr.exe or rubrik-agent) as suspicious activity.
  • Suggested Filter/Exclusion: Implement a process-based exclusion for known backup executables (e.g., VeeamAgentService.exe, RubrikBackupAgent). Additionally, exclude traffic originating from the specific subnet dedicated to the Data Center Backup VLAN where these agents reside.

• Scenario 3: Admin-Driven Patch Deployment via SCCM

  • Context: During major patch cycles, System Center Configuration Manager (SCCM) or Microsoft Intune pushes updates that require downloading large