This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the ClearFake campaign, which is known for sophisticated phishing and malware delivery tactics. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to identify early-stage infections or lateral movement attempts before they escalate into broader incidents across the organization’s cloud infrastructure.
Malware Family: ClearFake Total IOCs: 73 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | otmkyq.usen-bpzone.com | payload_delivery | 2026-08-13 | 100% |
| domain | zdklknv.us-en-us-cognisurge.com | payload_delivery | 2026-08-13 | 100% |
| domain | usen-bpzone.com | payload_delivery | 2026-08-13 | 100% |
| domain | us-en-us-cognisurge.com | payload_delivery | 2026-08-13 | 100% |
| domain | us-us-us-goldalign.com | payload_delivery | 2026-08-13 | 100% |
| domain | hatmnfx.usen-tinnitrol.com | payload_delivery | 2026-08-13 | 100% |
| domain | fprzbb.usechoxen.com | payload_delivery | 2026-08-13 | 100% |
| domain | usa-sugermute.com | payload_delivery | 2026-08-13 | 100% |
| domain | usen-tinnitrol.com | payload_delivery | 2026-08-13 | 100% |
| domain | usa-sugarmute-us.com | payload_delivery | 2026-08-13 | 100% |
| domain | llobae.usa-us-sugarmute.us | payload_delivery | 2026-08-13 | 100% |
| domain | fqtdjda.usen-thyrafemmebalance.com | payload_delivery | 2026-08-13 | 100% |
| domain | 5iywfu2r.vongquay8k.com | payload_delivery | 2026-08-13 | 100% |
| domain | usa-sightfresh.us | payload_delivery | 2026-08-13 | 100% |
| domain | usa-us-sugarmute.us | payload_delivery | 2026-08-13 | 100% |
| domain | usen-thyrafemmebalance.com | payload_delivery | 2026-08-13 | 100% |
| domain | opwvak.usa-us-sugarmute.com | payload_delivery | 2026-08-13 | 100% |
| domain | usa-keyslimdrops.com | payload_delivery | 2026-08-13 | 100% |
| domain | tqgyfdh.us-en--nervearmor.com | payload_delivery | 2026-08-13 | 100% |
| domain | us-en--nervearmor.com | payload_delivery | 2026-08-13 | 100% |
| domain | us-ennervearmor.com | payload_delivery | 2026-08-13 | 100% |
| domain | istounscnnd.beer | botnet_cc | 2026-08-13 | 90% |
| domain | mstclaudens.beer | botnet_cc | 2026-08-13 | 90% |
| domain | njnaqa.usa-usa-synaptigen.com | payload_delivery | 2026-08-13 | 100% |
| domain | usa-goldalign.us | payload_delivery | 2026-08-13 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["otmkyq.usen-bpzone.com", "zdklknv.us-en-us-cognisurge.com", "usen-bpzone.com", "us-en-us-cognisurge.com", "us-us-us-goldalign.com", "hatmnfx.usen-tinnitrol.com", "fprzbb.usechoxen.com", "usa-sugermute.com", "usen-tinnitrol.com", "usa-sugarmute-us.com", "llobae.usa-us-sugarmute.us", "fqtdjda.usen-thyrafemmebalance.com", "5iywfu2r.vongquay8k.com", "usa-sightfresh.us", "usa-us-sugarmute.us", "usen-thyrafemmebalance.com", "opwvak.usa-us-sugarmute.com", "usa-keyslimdrops.com", "tqgyfdh.us-en--nervearmor.com", "us-en--nervearmor.com", "us-ennervearmor.com", "istounscnnd.beer", "mstclaudens.beer", "njnaqa.usa-usa-synaptigen.com", "usa-goldalign.us", "usa-usa-synaptigen.com", "phgxuul.us-en--keyslimdrops.com", "us-enkeyslimdrops.com", "ongxxt.us-audizenn.com", "hhywcqm.us-eng-us-gutdrops.com", "us-audizenn.com", "usa-gold-align.com", "us-eng-us-gutdrops.com", "smurab.usa-tinnitrol.us", "xmpxsvb.usa-us-goldalign.com", "usa-tinnitrol.us", "usa-eng-synaptigen.com", "y2hs3ri6.josephmichaelnh.com", "mgogel.synptigen.com", "yreztzh.usa-us--goldalign.com", "usa-usgoldalign.com", "elwbwcn.usa-us-bpzone.com", "usa-us-bpzone.com", "usa-eng-gutdrops.com", "f7z38ywt.tiroalpaloes.co", "whmakm.synaptigen-usa.com", "vthaoip.get-sightfresh.com", "web-sighttfresh.com", "rohrtrenntechnik.ch", "gimmotech.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: The Security Operations Center (SOC) team manually ingests the latest “ClearFake” threat intelligence feed into the SIEM using Microsoft Defender for Endpoint or Splunk, causing a bulk import of all 73 IOCs which triggers the rule immediately upon ingestion.
Source is identified as the specific Threat Intel Platform (e.g., source_app = "ThreatIntelManager") and the action type is Ingestion or FeedUpdate.Scenario: A scheduled PowerShell job running on the central Domain Controller performs a nightly vulnerability assessment using Qualys or Tenable, which queries the ClearFake IOC database to update local asset tags, generating detection hits for each queried hash.
Process Name (e.g., powershell.exe) and Parent Process (e.g., Task Scheduler Service or svchost.exe) running during a defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: The IT Operations team executes a routine Group Policy Object (GPO) deployment to push new endpoint protection signatures, where the GPO script explicitly references ClearFake IOCs to whitelist specific application hashes on 500+ workstations simultaneously.
Security Channel or System Account (NT AUTHORITY\SYSTEM) where the Event ID corresponds to a known GPO update event (e.g., Event ID 4720 in Windows) and the source IP belongs to the internal management subnet.Scenario: An automated Jenkins CI/CD pipeline triggers a security scan on a new build artifact, utilizing an integrated plugin that