ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of nine specific IOCs linked to the ClearFake threat, which often indicates an adversary leveraging social engineering or credential harvesting tactics to establish initial access. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets early, preventing potential lateral movement or data exfiltration before the threat actor achieves their objectives.

IOC Summary

Malware Family: ClearFake Total IOCs: 9 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["varzeshitime.ir", "4h3y0wdh.varzeshitime.ir", "g66c3tx3.semilink.ir", "semilink.ir", "9s25krs9.dumanbett.co", "dumanbett.co", "dqtransformer.com", "fds4vs4l.luxerabet1000.com", "luxerabet1000.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A security operations team or threat intelligence platform (e.g., MISP, TheHive) automatically ingests and correlates IOCs from the ClearFake feed, resulting in legitimate network connections or DNS queries to known ClearFake infrastructure during routine enrichment processes.

  • Filter/Exclusion: Exclude source IPs belonging to the Threat Intelligence Platform (TIP) management subnet or specific service accounts (e.g., svc-ti-sync) from the detection logic.

• Scenario: A DevOps engineer or SRE is performing a live-fire exercise or chaos engineering test using a tool like Chaos Monkey or a custom Python script that intentionally references ClearFake IOCs to validate detection coverage before a major release.

  • Filter/Exclusion: Create a maintenance window exclusion for specific hostnames (e.g., dev-test-node-01) or exclude events where the process name is python.exe and the command line contains --chaos-test or clearfake-validation.

• Scenario: A legacy application or internal microservice has hardcoded configuration values or fallback endpoints that coincidentally match one of the 9 ClearFake IOCs (e.g., a specific IP or domain) due to historical network planning or shared hosting providers.

  • Filter/Exclusion: Identify the specific IOC (e.g., 192.0.2.10 or clearfake-cdn.net) and add an exclusion for the specific internal service account (e.g., app-legacy-inventory) or the specific source port/destination port combination if it is a known service.

• Scenario: An endpoint detection and response (EDR) agent or a network monitoring tool (e.g., Zeek, Suricata) is running a self-test or health check that pings or resolves ClearFake IOCs to verify its own sensor functionality and data pipeline integrity.