ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hypothesis targets the presence of ClearFake IOCs, which are known indicators associated with the ClearFake malware family that often leverages browser extensions to exfiltrate sensitive data. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or user sessions before the adversary can establish persistence or escalate privileges within the tenant.

IOC Summary

Malware Family: ClearFake Total IOCs: 13 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["r6qobdol.laken.store", "laken.store", "cu8d1374.us-eng-zensulin.com", "juhgjnjm.api24.store", "cvf9a6ez.alvare.store", "lgtbun4a.niaa.store", "www.credissimmo.fr", "www.viralabperu.com", "edilbertocosta.com", "52uj2wm2.7flex.store", "bkbmall.in", "www.werde-medium.com", "beit-shoresh.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A security operations team or incident response (IR) engineer manually deploys the ClearFake IOC list to a SIEM or EDR platform (e.g., Microsoft Sentinel, CrowdStrike Falcon) to validate detection coverage during a tabletop exercise or pre-incident preparation.
  • Filter/Exclusion: Exclude alerts where the source user account belongs to the SecurityOps or IR-Team security group, and the destination asset is a SIEM/EDR management console or a designated “test” subnet.
• Scenario: An automated vulnerability management or threat intelligence integration job (e.g., Tenable.io, Qualys, or a custom Python script) pulls the latest ClearFake IOCs from the ThreatFox API and pushes them to a central IOC repository or database for correlation.
  • Filter/Exclusion: Exclude events where the source process is a known automation tool (e.g., python.exe, curl.exe, wget.exe) and the destination is the internal Threat Intelligence Platform (TIP) or a specific IOC storage server (e.g., ioc-db-01.corp.local).
• Scenario: A DevOps or Platform Engineering team runs a scheduled CI/CD pipeline job that updates security baseline configurations or YARA rules in a configuration management system (e.g., Ansible, Puppet, Chef) by fetching the ClearFake IOC list to keep detection rules current.
  • Filter/Exclusion: Exclude alerts where the source host is a CI/CD runner or build server (e.g., jenkins-01, github-actions-runner), and the destination is the configuration management server or a specific “security-config” share.
• Scenario: A network security engineer performs a manual test by downloading the ClearFake IOC list to a jump host or bastion server to compare it against existing firewall rules or IDS signatures before deploying changes.