ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by identifying network and endpoint interactions matching the 32 specific indicators of compromise (IOCs) linked to the ClearFake threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because ClearFake’s high-severity profile suggests a sophisticated campaign that requires immediate visibility to prevent potential data exfiltration or lateral movement before automated alerts trigger.

IOC Summary

Malware Family: ClearFake Total IOCs: 32 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
domain	4lu4vaih.en-us--menbalancepro.com	payload_delivery	2026-08-26	100%
domain	k45ks1jv.enus-mindvault.com	payload_delivery	2026-08-26	100%
domain	enus-mindvault.com	payload_delivery	2026-08-26	100%
domain	enus-neurovera.com	payload_delivery	2026-08-26	100%
domain	compraventa.ebainet.es	payload_delivery	2026-08-26	90%
domain	tj2ay0gm.en-us--mindvault.com	payload_delivery	2026-08-26	100%
domain	en-us--mindvault.com	payload_delivery	2026-08-26	100%
domain	www.website-256db78e.sct.lof.mybluehost.me	payload_delivery	2026-08-26	90%
domain	en-us-neuro-vera.com	payload_delivery	2026-08-26	100%
domain	enus-neurosharp.com	payload_delivery	2026-08-26	100%
domain	king[.]369bbqsifangonline.com	botnet_cc	2026-08-26	100%
domain	macroad.it	payload_delivery	2026-08-26	90%
domain	heartandshape.com	payload_delivery	2026-08-26	90%
domain	www.dataspot.at	payload_delivery	2026-08-26	90%
domain	tn1io2hp.enus-menbalancepro.com	payload_delivery	2026-08-26	100%
domain	yawlixdf.en-us--levium.com	payload_delivery	2026-08-26	100%
domain	seal[.]369bbqsifangonline.com	botnet_cc	2026-08-26	90%
domain	2zz07wlf.verticalchurchfilms.org	payload_delivery	2026-08-26	100%
domain	lmq0ixtj.en-us-memrylift.com	payload_delivery	2026-08-26	100%
domain	enus-menbalancepro.com	payload_delivery	2026-08-26	100%
domain	en-us--levium.com	payload_delivery	2026-08-26	100%
domain	verticalchurchfilms.org	payload_delivery	2026-08-26	100%
domain	en-us-memrylift.com	payload_delivery	2026-08-26	100%
domain	kohatpromotions.com	payload_delivery	2026-08-26	90%
domain	www.depannage-serrurier-94.com	payload_delivery	2026-08-26	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["4lu4vaih.en-us--menbalancepro.com", "k45ks1jv.enus-mindvault.com", "enus-mindvault.com", "enus-neurovera.com", "compraventa.ebainet.es", "tj2ay0gm.en-us--mindvault.com", "en-us--mindvault.com", "www.website-256db78e.sct.lof.mybluehost.me", "en-us-neuro-vera.com", "enus-neurosharp.com", "king.369bbqsifangonline.com", "macroad.it", "heartandshape.com", "www.dataspot.at", "tn1io2hp.enus-menbalancepro.com", "yawlixdf.en-us--levium.com", "seal.369bbqsifangonline.com", "2zz07wlf.verticalchurchfilms.org", "lmq0ixtj.en-us-memrylift.com", "enus-menbalancepro.com", "en-us--levium.com", "verticalchurchfilms.org", "en-us-memrylift.com", "kohatpromotions.com", "www.depannage-serrurier-94.com", "allunitedcontracting.com", "en-us-en-lipovive.us", "en-us-en-morningcoffeeritual.com", "en-us-aquaburnn.com", "cnvdlaw.com", "couvoir.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/Justin-97483/96yfds4hd/rttt34-45"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection often download updated definition signatures from the vendor’s cloud repository. These updates frequently reference IOCs (hashes, domains) that match the ClearFake campaign profile as part of their baseline threat intelligence feed synchronization.
  • Filter/Exclusion: Exclude traffic originating from the specific update service accounts or processes.
    • Filter: Process Name IN ("MsMpEng.exe", "Symantec Endpoint Protection Client") AND Source IP IN (Internal Update Server Range).

• Scenario: Security Information and Event Management (SIEM) Ingestion

  • Context: The organization’s SIEM platform, such as Splunk Enterprise Security or Microsoft Sentinel, periodically ingests threat intelligence feeds from ThreatFox. During the ingestion pipeline, the system may generate internal telemetry events that match the ClearFake IOC signatures while parsing and normalizing data before it reaches the endpoint agents.
  • Filter/Exclusion: Create a rule exclusion for traffic generated by the SIEM’s own collector nodes or management servers.
    • Exclusion: Source Host IN (SIEM Collector Group) OR Process Name = "Splunkd.exe" / “SentinelAgent.exe”.

• Scenario: Automated Vulnerability Scanning Jobs

  • Context: Scheduled vulnerability assessments performed by tools like Qualys Cloud Agent or Tenable Nessus often probe network ports and services. These scanners may initiate connections to external threat intelligence APIs (including ClearFake sources) to enrich scan results, triggering the detection logic on the scanning