ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of ClearFake IOCs, a known threat intelligence feed associated with malicious activity, to identify potential compromises within the Azure environment. Proactively hunting for these indicators allows the SOC to detect early-stage intrusions or persistent threats before they escalate, leveraging high-severity intelligence to reduce mean time to detection.

IOC Summary

Malware Family: ClearFake Total IOCs: 35 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`peluqueriainesgarcia.es`	payload_delivery	2026-09-10	90%
domain	`nakhlatee.com`	payload_delivery	2026-09-10	90%
domain	`nanohaarpigmentierung.de`	payload_delivery	2026-09-10	90%
domain	`pascalcossu.com`	payload_delivery	2026-09-10	90%
domain	`s0ls07nv.www-genesisrevival.com`	payload_delivery	2026-09-10	100%
domain	`paintmyparkinglot.com`	payload_delivery	2026-09-10	90%
domain	`looseningcaptivesblog.com`	payload_delivery	2026-09-10	90%
domain	`linuxbazar.com`	payload_delivery	2026-09-10	90%
domain	`lazycatagency.com`	payload_delivery	2026-09-10	90%
domain	`mariafinch.com`	payload_delivery	2026-09-10	90%
domain	`ortodoncia-invisible-valencia.com`	payload_delivery	2026-09-10	90%
domain	`bdidap9p.borderlinelakewood.com`	payload_delivery	2026-09-10	100%
domain	`kidderporecollege.in`	payload_delivery	2026-09-10	90%
domain	`kendalfortson.com`	payload_delivery	2026-09-10	90%
domain	`omumedia.co.id`	payload_delivery	2026-09-10	90%
domain	`openmundi.com.br`	payload_delivery	2026-09-10	90%
domain	`73x4a00h.us-us-us-zensulin.com`	payload_delivery	2026-09-10	100%
domain	`by1r8hqk.us-eng-zensulin.com`	payload_delivery	2026-09-10	100%
domain	`www.novahelixlabs.com`	payload_delivery	2026-09-10	90%
domain	`novaairsolutions.com`	payload_delivery	2026-09-10	90%
domain	`nucosolutions.co.uk`	payload_delivery	2026-09-10	90%
domain	`www.nyclimopass.com`	payload_delivery	2026-09-10	90%
domain	`northlondonmobiletyrefitting.co.uk`	payload_delivery	2026-09-10	90%
domain	`jl4wdm8i.bobatouch.com`	payload_delivery	2026-09-10	100%
domain	`nhakhoatandinh.com`	payload_delivery	2026-09-10	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["peluqueriainesgarcia.es", "nakhlatee.com", "nanohaarpigmentierung.de", "pascalcossu.com", "s0ls07nv.www-genesisrevival.com", "paintmyparkinglot.com", "looseningcaptivesblog.com", "linuxbazar.com", "lazycatagency.com", "mariafinch.com", "ortodoncia-invisible-valencia.com", "bdidap9p.borderlinelakewood.com", "kidderporecollege.in", "kendalfortson.com", "omumedia.co.id", "openmundi.com.br", "73x4a00h.us-us-us-zensulin.com", "by1r8hqk.us-eng-zensulin.com", "www.novahelixlabs.com", "novaairsolutions.com", "nucosolutions.co.uk", "www.nyclimopass.com", "northlondonmobiletyrefitting.co.uk", "jl4wdm8i.bobatouch.com", "nhakhoatandinh.com", "goodlong.life", "newpurpose.org", "www.navarriniarchitetti.it", "elimargomes.com.br", "equiscoperes.com", "enlineard.net", "escoladeemagrecimento.com", "natureelitehealth.online", "8otqtzmy.ydns.shop", "ydns.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — ClearFake

False Positive Guidance

Scenario: Automated Malware Analysis Sandbox Execution
- Description: Security teams or developers run ClearFake in an isolated CI/CD pipeline or a dedicated malware analysis sandbox (e.g., using Any.Run, Joe Sandbox, or Hybrid Analysis) to test detection coverage or analyze new variants. The IOCs (hashes, URLs, or file paths) appear in logs from the sandbox agent or the CI runner (e.g., Jenkins or GitHub Actions) as part of a legitimate test job.
- Filter/Exclusion: Exclude alerts where the source host is a known sandbox VM (e.g., hostname matches sandbox-* or IP range 10.20.0.0/24) or where the process parent is a known CI/CD agent like java.exe (Jenkins) or node.exe (GitHub Actions) within the specific project directory.
Scenario: Threat Intelligence Feed Ingestion and Correlation
- Description: The SIEM or EDR platform ingests a bulk threat intelligence feed (e.g., from MISP, OpenCTI, or ThreatConnect) that includes ClearFake IOCs for correlation purposes. During the ingestion process, the IOCs are written to a local database or staging folder on the SIEM collector node, triggering file-based or hash-based detections.
- Filter/Exclusion: Exclude alerts originating from the SIEM/EDR management server (e.g., hostname siem-collector-01) or where the file path resides in the threat intelligence staging directory (e.g., /opt/threatintel/staging/ or C:\ProgramData\SIEM\feeds\).
Scenario: Security Team IOC Validation and Testing
- Description: A SOC analyst or threat hunter manually downloads the ClearFake sample