ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by monitoring for matches against a curated set of 51 specific indicators of compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical due to the high severity of ClearFake’s sophisticated phishing and malware delivery tactics, which often target enterprise environments with advanced persistence mechanisms.

IOC Summary

Malware Family: ClearFake Total IOCs: 51 IOC Types: url, domain, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
domain	cabinetbedstore.com	payload_delivery	2026-08-15	90%
domain	bexterlab.com	payload_delivery	2026-08-15	90%
domain	backspindignitystore.ca	payload_delivery	2026-08-15	90%
domain	aurobatariq.com	payload_delivery	2026-08-15	90%
domain	basetrove.net	payload_delivery	2026-08-15	90%
domain	amazonfox.com.br	payload_delivery	2026-08-15	90%
domain	ar1servicesltd.co.uk	payload_delivery	2026-08-15	90%
domain	qh00u7b9.en-slimsounds.com	payload_delivery	2026-08-15	100%
domain	arcuniversities.co.uk	payload_delivery	2026-08-15	90%
domain	add-up.fr	payload_delivery	2026-08-15	90%
domain	atelierspyros.com	payload_delivery	2026-08-15	90%
domain	alps.exchange	payload_delivery	2026-08-15	90%
domain	aml-compliance.org	payload_delivery	2026-08-15	90%
domain	aipower.wiki	payload_delivery	2026-08-15	90%
domain	brain-board.ch	payload_delivery	2026-08-15	90%
domain	amlscores.com	payload_delivery	2026-08-15	90%
sha256_hash	ecf6696f5ecd642a27033782163e51e890e59151762e37a76897637eb620db3c	payload	2026-08-15	90%
domain	rn255nbo.eng-slimsounds.com	payload_delivery	2026-08-15	100%
domain	5bpers6h.en-en-usa-sightfresh.com	payload_delivery	2026-08-15	100%
domain	alphasolarsystems.ch	payload_delivery	2026-08-15	90%
domain	bvm9kxn7.gut--drops.com	payload_delivery	2026-08-15	100%
domain	gtmdura4.en-us-slimsplits.com	payload_delivery	2026-08-15	100%
domain	90uk7unu.eachway-multiplier.com	payload_delivery	2026-08-15	100%
domain	allinmental.ch	payload_delivery	2026-08-15	90%
domain	v22eqt8a.drubenginecologo.com	payload_delivery	2026-08-15	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["cabinetbedstore.com", "bexterlab.com", "backspindignitystore.ca", "aurobatariq.com", "basetrove.net", "amazonfox.com.br", "ar1servicesltd.co.uk", "qh00u7b9.en-slimsounds.com", "arcuniversities.co.uk", "add-up.fr", "atelierspyros.com", "alps.exchange", "aml-compliance.org", "aipower.wiki", "brain-board.ch", "amlscores.com", "rn255nbo.eng-slimsounds.com", "5bpers6h.en-en-usa-sightfresh.com", "alphasolarsystems.ch", "bvm9kxn7.gut--drops.com", "gtmdura4.en-us-slimsplits.com", "90uk7unu.eachway-multiplier.com", "allinmental.ch", "v22eqt8a.drubenginecologo.com", "milpl8xr.eng-neuroxen.com", "bodenindexpunkte.ch", "meps.co.mz", "alpentransitboerse.ch", "deryabakbak.com.tr", "wc2z5pjy.digeststart.us", "4fg0jkkv.greaternewzionbc.org", "dc6z7ywb.en-us-energyrevolution.com", "unfourtel.es", "myintranet.ch", "kxkdfydq.crownconnectpk.com", "jastapway.com", "arezzofrigo.it", "bittemachdas.de", "cb2kljpv.eng--slimsounds.com", "dr4klu2c.buy-goldalign.com", "xp2v23h9.goldalignn.com", "f8i37n8m.en-theslimsplitsmethod.com", "fos41h2r.app8k.xyz", "gtg-tobacco.de", "o0hs8g3u.web-sighttfresh.com", "7xonfe62.en-usa-sugarmute.us", "sys32.ch", "qeecqeu6.go-neuroxen.com", "svqta9j3.usa-us-goldalign.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/kud-981/bunt@charred/error"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ClearFake
let malicious_hashes = dynamic(["ecf6696f5ecd642a27033782163e51e890e59151762e37a76897637eb620db3c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including targeted filters and exclusions:

• Scenario: Enterprise Antivirus/EDR Definition Updates

  • Context: Major security vendors (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently update their threat intelligence feeds. The “ClearFake” campaign often shares IOCs with standard malware definition updates or specific EDR signature blocks that trigger on the same hash ranges.
  • Filter/Exclusion: Exclude alerts where the source process is C:\Program Files\CrowdStrike\fsquarantine.exe (CrowdStrike) or C:\Windows\System32\DefenderSvc.exe (Microsoft Defender), provided the action type is “Update” or “Scan”.
  • Implementation: Add a filter: Process_Name IN ("fsquarantine.exe", "DefenderSvc.exe") AND Event_Type = "Signature_Update".

• Scenario: Scheduled Threat Intelligence Feed Ingestion

  • Context: The organization runs an automated nightly job using a tool like Tenable One or Qualys Cloud Agent to ingest external threat feeds. This ingestion process often downloads and parses the exact 51 IOCs associated with ClearFake, causing the detection engine to flag them as new “suspicious” activity rather than expected data processing.
  • Filter/Exclusion: Create a whitelist for scheduled tasks running between 02:00 and 04:00 UTC on weekdays that originate from the dedicated SIEM ingestion server (e.g., SIEM-INGEST-01).
  • Implementation: Exclude alerts where Host_Name = "SIEM-INGEST-01" AND Time_Between("02:00", "04:00") AND