This hunt identifies potential compromise by scanning for the seven specific IOCs linked to the ClearFake malware family, which is known for targeting cloud environments and leveraging legitimate tools for persistence. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect and isolate infected assets before the adversary can establish a foothold or execute lateral movement within the cloud infrastructure.
Malware Family: ClearFake Total IOCs: 7 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | kvoxeozq.ghadi.store | payload_delivery | 2026-09-16 | 100% |
| domain | gesundheitsnachweis24.de | payload_delivery | 2026-09-16 | 90% |
| domain | s6qvly4b.fews.store | payload_delivery | 2026-09-16 | 100% |
| domain | eqngjv6s.moltem.store | payload_delivery | 2026-09-16 | 100% |
| domain | occidentalconstruction.com | payload_delivery | 2026-09-16 | 90% |
| domain | labioforneria.ch | payload_delivery | 2026-09-16 | 90% |
| domain | v6sjo9pv.omec.store | payload_delivery | 2026-09-16 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["kvoxeozq.ghadi.store", "gesundheitsnachweis24.de", "s6qvly4b.fews.store", "eqngjv6s.moltem.store", "occidentalconstruction.com", "labioforneria.ch", "v6sjo9pv.omec.store"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A security operations engineer manually validates the ClearFake IOCs during a quarterly threat intelligence review or incident response drill, intentionally executing the associated binaries or accessing the known C2 domains to confirm detection coverage.
SOC-Engineers or Threat-Hunters AD group, or where the process parent is a known hunting tool such as Sysinternals\PsExec.exe or FalconPy.Scenario: An automated vulnerability scanner (e.g., Tenable Nessus or Qualys) performs a deep scan of the enterprise network, generating outbound connections to the ClearFake C2 IPs or executing test payloads to verify patch levels and network segmentation.
Vulnerability-Scanner asset tag in CMDB, or where the initiating process is nessus.exe, qualys_agent.exe, or scan_engine.exe.Scenario: A DevOps team deploys a new microservice container that includes a legacy dependency or test fixture referencing one of the ClearFake IOCs (e.g., a hardcoded URL or IP in a configuration file used for load testing against a staging environment).
staging, dev, or test, or where the process is running within a Kubernetes namespace labeled environment: non-prod.Scenario: A third-party SaaS application (e.g., a customer support chat widget or analytics SDK) embedded in the corporate intranet portal makes a background request to a shared CDN or API endpoint that coincidentally matches one of the ClearFake IOCs due to IP reuse or domain aliasing.