This hypothesis targets the presence of ClearFake IOCs, which are indicators linked to a known threat actor or campaign, to identify potential compromise or reconnaissance activity within the environment. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to detect early-stage intrusions or lateral movement attempts before they escalate into a full-blown breach.
Malware Family: ClearFake Total IOCs: 137 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | www.sahak.ch | payload_delivery | 2026-09-09 | 90% |
| domain | greenlandperu.com | payload_delivery | 2026-09-09 | 90% |
| domain | globalprivateequitypartners.com | payload_delivery | 2026-09-09 | 90% |
| domain | goldbaecker.de | payload_delivery | 2026-09-09 | 90% |
| domain | goodnewsnepalministry.org | payload_delivery | 2026-09-09 | 90% |
| domain | www.goldcoastdisabilityservices.com.au | payload_delivery | 2026-09-09 | 90% |
| domain | glowbeautybd.com | payload_delivery | 2026-09-09 | 90% |
| domain | www.graduatemonkey.com | payload_delivery | 2026-09-09 | 90% |
| domain | gloryspinning.com | payload_delivery | 2026-09-09 | 90% |
| domain | goeppinger-city.de | payload_delivery | 2026-09-09 | 90% |
| domain | www.gonextgroup.com | payload_delivery | 2026-09-09 | 90% |
| domain | gmattos.com.br | payload_delivery | 2026-09-09 | 90% |
| domain | gpicoop.org | payload_delivery | 2026-09-09 | 90% |
| domain | greenmoringathermal.com | payload_delivery | 2026-09-09 | 90% |
| domain | e99is6wd.www-bellyflush.com | payload_delivery | 2026-09-09 | 100% |
| domain | gaye.com.tr | payload_delivery | 2026-09-09 | 90% |
| domain | ghanaianwaynj.com | payload_delivery | 2026-09-09 | 90% |
| domain | kirche-sk.daniel-andernach.com | payload_delivery | 2026-09-09 | 90% |
| domain | www.georgiasentinelnews.com | payload_delivery | 2026-09-09 | 90% |
| domain | www.gentlegeek.net | payload_delivery | 2026-09-09 | 90% |
| domain | der-kaiser-spricht.net | payload_delivery | 2026-09-09 | 90% |
| domain | gizmofy.website | payload_delivery | 2026-09-09 | 90% |
| domain | vitalhealingnow.com | payload_delivery | 2026-09-09 | 90% |
| domain | ginajohnson.co | payload_delivery | 2026-09-09 | 90% |
| domain | globalmobilization.org | payload_delivery | 2026-09-09 | 90% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["www.sahak.ch", "greenlandperu.com", "globalprivateequitypartners.com", "goldbaecker.de", "goodnewsnepalministry.org", "www.goldcoastdisabilityservices.com.au", "glowbeautybd.com", "www.graduatemonkey.com", "gloryspinning.com", "goeppinger-city.de", "www.gonextgroup.com", "gmattos.com.br", "gpicoop.org", "greenmoringathermal.com", "e99is6wd.www-bellyflush.com", "gaye.com.tr", "ghanaianwaynj.com", "kirche-sk.daniel-andernach.com", "www.georgiasentinelnews.com", "www.gentlegeek.net", "der-kaiser-spricht.net", "gizmofy.website", "vitalhealingnow.com", "ginajohnson.co", "globalmobilization.org", "giftmeahome.com", "giftscrux.com", "freetimebd.com", "www.wesendit.com", "www.ftssoft.net", "fynga.com", "gabrielachamale.com", "www.friendly-dog.it", "fullbodyshaving.com", "www.gamersub.xyz", "www.agriturismodapion.it", "www.agba-avocats.com", "thesurfacemastersal.com", "almujaddidltd.com", "amesd.com", "alchemy-concepts.com", "almalitha.com", "amcad.org", "altiva.com.mx", "auditien.fr", "www.astralnaturedescanso.com", "aprotec.pro", "www.ashokjewels.com", "athomeent.com", "appliance-repair-expert.site"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice that includes a dependency on a library hosted on a public npm or PyPI registry. If the specific version of that library is associated with a ClearFake IOC (often due to typosquatting or compromised upstream dependencies), the artifact download or execution may match the IOC list.
jenkins, github-actions) or where the parent process is a known build tool (e.g., node.exe, python.exe, mvn.exe) and the file path resides within a standard workspace directory (e.g., C:\Jenkins\workspace\, /home/runner/work/).Scenario: An IT administrator performs a routine patching cycle using a tool like SCCM (System Center Configuration Manager) or PDQ Deploy. The patch package may include a helper script or binary that was previously flagged by ThreatFox due to a low-confidence IOC (e.g., a specific hash or URL) that has since been resolved or is a known false positive for that specific vendor.
ccmexec.exe, pdqdeploy.exe) and the file path is located in the standard software distribution folder (e.g., C:\Windows\CCM\, C:\Program Files (x86)\PDQ\).Scenario: A security team runs a YARA scan or memory dump analysis using a tool like Volatility or YARA on a live system to investigate a suspected incident. The tool itself or the sample being analyzed may contain strings or hashes that match ClearFake IOCs because the sample is a known malware variant