ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific Indicators of Compromise (IOCs) linked to the ClearFake malware family, which is known for its sophisticated fileless and macro-based attack vectors. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to identify early-stage infections and potential lateral movement before the threat escalates into a full-scale compromise.

IOC Summary

Malware Family: ClearFake Total IOCs: 16 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	groupes-artiste.com	payload_delivery	2026-08-18	90%
domain	microstates-conference.com	payload_delivery	2026-08-18	90%
domain	gestaltgenevelaurencehuber.ch	payload_delivery	2026-08-18	90%
domain	ljfsm.ch	payload_delivery	2026-08-18	90%
domain	dravir.fr	payload_delivery	2026-08-18	90%
domain	adonnante.com	payload_delivery	2026-08-18	90%
domain	kanopy.fr	payload_delivery	2026-08-18	90%
domain	9tj7h8tb.usa-us-goldalign.com	payload_delivery	2026-08-18	100%
domain	coolreptiles.com	payload_delivery	2026-08-18	90%
domain	georgehennig.com	payload_delivery	2026-08-18	90%
domain	autruche-volante.org	payload_delivery	2026-08-18	90%
domain	y18pd2i2.havenchurchraleigh.com	payload_delivery	2026-08-18	100%
domain	gvbbvohe.en-slimsounds.com	payload_delivery	2026-08-18	100%
domain	gigifilare.it	payload_delivery	2026-08-18	90%
domain	repdev.ch	payload_delivery	2026-08-18	90%
domain	carpet-sail.com	botnet_cc	2026-08-18	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["groupes-artiste.com", "microstates-conference.com", "gestaltgenevelaurencehuber.ch", "ljfsm.ch", "dravir.fr", "adonnante.com", "kanopy.fr", "9tj7h8tb.usa-us-goldalign.com", "coolreptiles.com", "georgehennig.com", "autruche-volante.org", "y18pd2i2.havenchurchraleigh.com", "gvbbvohe.en-slimsounds.com", "gigifilare.it", "repdev.ch", "carpet-sail.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Security Team Manual Threat Hunting Queries

  • Context: Security analysts frequently query the ThreatFox platform directly via its API or web console to validate specific IOCs (Indicators of Compromise) during active incident response. This generates network traffic matching the ClearFake IOC patterns as part of a legitimate workflow, not an actual compromise.
  • Filter/Exclusion: Create a rule exclusion based on source IP ranges assigned to the SOC Analyst Workstations and the ThreatFox Appliance itself. Additionally, exclude traffic where the User-Agent string contains ThreatFox-Client or specific API headers used by internal hunting scripts.

• Scenario: Scheduled Endpoint Protection Policy Updates

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) often pull threat intelligence feeds from ThreatFox on a scheduled basis (e.g., every 4 hours) to update their local IOC databases. This background synchronization triggers the detection logic without indicating a new threat event.
  • Filter/Exclusion: Implement an exclusion based on the Process Name of the endpoint agent (e.g., FalconSensor.exe, SentinelOneAgent.exe) and filter out events occurring during known maintenance windows (e.g., 02:00 – 04:00 UTC). Exclude traffic where the destination port matches the standard feed update ports used by these vendors.

• Scenario: Automated SIEM Correlation Engine Jobs

  • Context: The enterprise SIEM (such as Splunk, IBM QRadar, or Microsoft Sentinel) runs a nightly scheduled job to ingest and normalize IOC