This hypothesis targets the presence of ClearFake IOCs, a high-severity threat often associated with credential stuffing and fake account creation campaigns that can lead to account takeover. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised identities or active attack infrastructure before adversaries leverage them for further lateral movement or data exfiltration.
Malware Family: ClearFake Total IOCs: 25 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | ye8ne339.dokturumsensin.com | payload_delivery | 2026-09-28 | 100% |
| domain | 35su8ccd.favarzesh.ir | payload_delivery | 2026-09-28 | 100% |
| domain | favarzesh.ir | payload_delivery | 2026-09-28 | 100% |
| domain | 0gnu5zak.edebiyatkonulari.com | payload_delivery | 2026-09-28 | 100% |
| domain | b5hqgkl3.kaarenorge.com | payload_delivery | 2026-09-28 | 100% |
| domain | 8s896faj.varzesh303.com | payload_delivery | 2026-09-28 | 100% |
| domain | tuitionfarm.co.uk | payload_delivery | 2026-09-28 | 90% |
| domain | twilldistilled.com | payload_delivery | 2026-09-28 | 90% |
| domain | thehamptonhomestead.com | payload_delivery | 2026-09-28 | 90% |
| domain | thediva.ca | payload_delivery | 2026-09-28 | 90% |
| domain | thecomfycurator.com | payload_delivery | 2026-09-28 | 90% |
| domain | www.rentclub.it | payload_delivery | 2026-09-28 | 90% |
| domain | www.revzonebd.com | payload_delivery | 2026-09-28 | 90% |
| domain | www.rethinkfinance.org | payload_delivery | 2026-09-28 | 90% |
| domain | www.rebellawyers.com | payload_delivery | 2026-09-28 | 90% |
| domain | skindustries.in | payload_delivery | 2026-09-28 | 90% |
| domain | tajabeverages.com | payload_delivery | 2026-09-28 | 90% |
| domain | bagueie.xyz | payload_delivery | 2026-09-28 | 90% |
| domain | whitewingsholding.com | payload_delivery | 2026-09-28 | 90% |
| domain | solvisistemas.com | payload_delivery | 2026-09-28 | 90% |
| domain | unitedtopquality.com | payload_delivery | 2026-09-28 | 90% |
| domain | www.recon-usa.org | payload_delivery | 2026-09-28 | 90% |
| domain | spokanehimm.com | payload_delivery | 2026-09-28 | 90% |
| domain | vololift.com | payload_delivery | 2026-09-28 | 90% |
| domain | khcceg0f.elipsbet.poker | payload_delivery | 2026-09-28 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["ye8ne339.dokturumsensin.com", "35su8ccd.favarzesh.ir", "favarzesh.ir", "0gnu5zak.edebiyatkonulari.com", "b5hqgkl3.kaarenorge.com", "8s896faj.varzesh303.com", "tuitionfarm.co.uk", "twilldistilled.com", "thehamptonhomestead.com", "thediva.ca", "thecomfycurator.com", "www.rentclub.it", "www.revzonebd.com", "www.rethinkfinance.org", "www.rebellawyers.com", "skindustries.in", "tajabeverages.com", "bagueie.xyz", "whitewingsholding.com", "solvisistemas.com", "unitedtopquality.com", "www.recon-usa.org", "spokanehimm.com", "vololift.com", "khcceg0f.elipsbet.poker"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a new version of a microservice that includes a dependency on a specific open-source library. If that library’s SHA256 hash or file path matches one of the 25 ClearFake IOCs (often associated with specific malware families or known bad artifacts), the detection will trigger on the deployment artifact.
jenkins-agent.exe, gitlab-runner.exe) and the destination path is within a standard build or artifact directory (e.g., /opt/ci/artifacts/, C:\Jenkins\workspace\).Scenario: An IT administrator performs a routine backup verification or disaster recovery test using a tool like Veeam Backup & Replication or Commvault. The backup software may temporarily restore or scan files to a staging area, and if a file’s metadata (hash, name, or path) coincidentally matches a ClearFake IOC (e.g., a common filename like update.exe or a specific hash used in a test image), the rule fires.
VeeamBackup.exe, commvault_agent.exe) and the file location is within a designated backup or staging directory (e.g., \\backup-server\staging\, C:\Backup\Temp\).Scenario: A security team conducts a tabletop exercise or a controlled malware analysis in a sandboxed environment (e.g., using Any.run, Joe Sandbox, or a dedicated VM). They intentionally download and execute a sample that matches one of the ClearFake IOCs to test detection coverage. The alert is expected but may be logged as a false positive if not