ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against known ClearFake indicators of compromise to identify potential lateral movement or data exfiltration attempts. Proactively hunting for these specific IOCs is critical because ClearFake represents a sophisticated threat actor capable of evading standard perimeter defenses, requiring deep internal visibility to prevent early-stage infection and containment.

IOC Summary

Malware Family: ClearFake Total IOCs: 13 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["ttjmpding.biodentax.com", "biodentax.com", "leaf.lonnyross.com", "eng-eng-us-lipovive.com", "kg30.ch", "residence-symbiose.ch", "eng-eng-beastforce.com", "nmf-training.ch", "bobance.com", "aadsp-danse.com", "tk7r5jj6.bjkg.store", "bjkg.store"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/marye4562/rtt76gf84j/re49jmt98"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

Here are the false positive scenarios and corresponding exclusion strategies for the ThreatFox: ClearFake IOCs detection rule:

• Scenario 1: Scheduled Antivirus Definition Updates

  • Context: The enterprise uses Microsoft Defender for Endpoint. Every Tuesday at 02:00 AM, a scheduled task triggers an update that downloads and installs new virus definition signatures. These definitions often contain hash values or file paths matching the ClearFake IOCs (e.g., specific DLLs used in the signature database).
  • Filter/Exclusion: Create a time-based exclusion rule to suppress alerts for this detection between 01:30 AM and 04:00 AM on Tuesdays, specifically targeting the Microsoft Defender Antivirus Service process ID or the specific host group “AV-Update-Servers”.

• Scenario 2: Software Deployment via Configuration Management

  • Context: The IT team utilizes Ansible to deploy a new version of the internal HR portal. During the deployment, Ansible pushes a configuration script that installs a dependency library (libclearfake.dll) which shares a known hash with one of the ClearFake IOCs. This triggers an alert during routine maintenance windows.
  • Filter/Exclusion: Add a process exclusion for ansible-runner.exe (or the specific inventory host group “HR-Portal-Deploy”) and whitelist the specific file path C:\Program Files\InternalApps\HR\libclearfake.dll in the detection logic.

• Scenario 3: Third-Party Backup Agent Scans

  • Context: The organization runs Veeam Backup & Replication. During nightly backup cycles, the Veeam agent scans specific application directories and generates temporary log files or checksums that align with ClearFake’s IOCs. This is a routine administrative task rather than malicious activity.