ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by identifying interactions with its specific set of twelve known indicators of compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical because ClearFake’s sophisticated use of fake documents and macro-based delivery allows it to bypass standard perimeter defenses, necessitating deep inspection of internal telemetry to catch early-stage lateral movement.

IOC Summary

Malware Family: ClearFake Total IOCs: 12 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["shootartphotografie.ch", "saas-stash.beer", "glycomutee.com", "xk282qui.shop-lipovive.us", "228fsijc.therodeoroundup.com", "n5o3lrw5.usen-glucotrust-bites.com", "nioas33l.shop-aquaburn.us", "bccykgbs.qummy-group.com", "dacey.agency"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://raw.githubusercontent.com/frantario/tropa47/refs/heads/main/lytkc14", "https://raw.githubusercontent.com/Loolu2846/ruta3742/refs/heads/main/rita80", "https://raw.githubusercontent.com/cowenrty/retushrem/refs/heads/main/neli"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with targeted exclusion strategies:

• Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) automatically downloads and hashes a new “ClearFake” definition update package during its nightly maintenance window.

  • Exclusion/Filter: Create an exclusion based on the Process Name (falcon.sys or MsMpEng.exe) and restrict the alert to occur only outside of the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: A scheduled PowerShell script running via Windows Task Scheduler executes a routine compliance check that queries the ClearFake API to validate current threat intelligence feeds.

  • Exclusion/Filter: Filter alerts where the Parent Process is TaskScheduler.exe and the Command Line contains specific keywords like “ComplianceCheck” or the script path (e.g., C:\Scripts\DailyFeedValidation.ps1).

• Scenario: The IT Security team manually deploys a new ClearFake IOC list to the SIEM using an automated Ansible playbook from a known jump host (bastion server).

  • Exclusion/Filter: Exclude events originating from the specific Source IP Address of the bastion host and where the User Account matches the service account used for automation (e.g., svc-sec-deploy).

• Scenario: A third-party vulnerability scanner (such as Tenable Nessus or Qualys) performs a scheduled scan that includes network traffic analysis involving ClearFake’s public IP ranges.

  • Exclusion/Filter: Apply a filter excluding the specific Source Port used by the scanner agent and whitelisting the known **