This hunt targets adversary behavior involving the execution of known ClearFake malware indicators across endpoints to identify potential supply chain compromises or initial access vectors. Proactively hunting these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat family allows the SOC team to rapidly isolate affected assets before lateral movement occurs.
Malware Family: ClearFake Total IOCs: 59 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | senorgyros.com | payload_delivery | 2026-07-18 | 100% |
| domain | pathfindersafrica.com | payload_delivery | 2026-07-18 | 100% |
| domain | yvzqh.hazaratbet.game | payload_delivery | 2026-07-18 | 100% |
| domain | vwpanxmoc.orlandosmuncy.com | payload_delivery | 2026-07-18 | 100% |
| domain | jifyi.gamehazarat.com | payload_delivery | 2026-07-18 | 100% |
| domain | orlandosmuncy.com | payload_delivery | 2026-07-18 | 100% |
| domain | 7uaho90m.myluxurykitchenandbath.com | payload_delivery | 2026-07-18 | 100% |
| domain | myluxurykitchenandbath.com | payload_delivery | 2026-07-18 | 100% |
| domain | lbtzq.funxbet.casino | payload_delivery | 2026-07-18 | 100% |
| domain | kgptwmgqf.taktikkbet.com | payload_delivery | 2026-07-18 | 100% |
| domain | yblfhadfu.mango90bet.com | payload_delivery | 2026-07-18 | 100% |
| domain | mango90bet.com | payload_delivery | 2026-07-18 | 100% |
| domain | rmxohycah.sky7bet.casino | payload_delivery | 2026-07-18 | 100% |
| domain | heork.derbi.promo | payload_delivery | 2026-07-18 | 100% |
| domain | 8862moud.mikespizzafairfield.com | payload_delivery | 2026-07-18 | 100% |
| domain | mikespizzafairfield.com | payload_delivery | 2026-07-18 | 100% |
| domain | mpuwd.deepspaceparker.com | payload_delivery | 2026-07-18 | 100% |
| domain | uvxzsajar.lion1bet.com | payload_delivery | 2026-07-18 | 100% |
| domain | atqfb.calirayalake.com | payload_delivery | 2026-07-18 | 100% |
| domain | jppxuuhae.imagederm.com | payload_delivery | 2026-07-18 | 100% |
| domain | 5ipju606.venus90bet.com | payload_delivery | 2026-07-18 | 100% |
| domain | hdz7omr1.nextbahis.blog | payload_delivery | 2026-07-18 | 100% |
| domain | i0bep9cj.medallionfoodsinctempura.com | payload_delivery | 2026-07-18 | 100% |
| domain | medallionfoodsinctempura.com | payload_delivery | 2026-07-18 | 100% |
| domain | olyqj.luxurygoodscaree.com | payload_delivery | 2026-07-18 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["senorgyros.com", "pathfindersafrica.com", "yvzqh.hazaratbet.game", "vwpanxmoc.orlandosmuncy.com", "jifyi.gamehazarat.com", "orlandosmuncy.com", "7uaho90m.myluxurykitchenandbath.com", "myluxurykitchenandbath.com", "lbtzq.funxbet.casino", "kgptwmgqf.taktikkbet.com", "yblfhadfu.mango90bet.com", "mango90bet.com", "rmxohycah.sky7bet.casino", "heork.derbi.promo", "8862moud.mikespizzafairfield.com", "mikespizzafairfield.com", "mpuwd.deepspaceparker.com", "uvxzsajar.lion1bet.com", "atqfb.calirayalake.com", "jppxuuhae.imagederm.com", "5ipju606.venus90bet.com", "hdz7omr1.nextbahis.blog", "i0bep9cj.medallionfoodsinctempura.com", "medallionfoodsinctempura.com", "olyqj.luxurygoodscaree.com", "luxurygoodscaree.com", "dogfrpygx.hazzarat.com", "acvwd.lunapizzaco.com", "lunapizzaco.com", "ubwzdjejr.fun777game.org", "fun777game.org", "4j6m037n.mcbelize.com", "mcbelize.com", "tygnu.lokercorp.com", "lokercorp.com", "cgocpkfgd.fg777tasya.net", "fg777tasya.net", "cvyfg.kopicoffeeco.com", "kopicoffeeco.com", "isrjnxfeb.fg777kito.com", "fg777kito.com", "nle3gi30.makingreview.com", "makingreview.com", "nyenf.kmmits.com", "cqjeqfltg.fg777jbg.net", "fg777jbg.net", "no3htbxq.varzeshlife.ir", "y4h1lqu6.jadoou.lat", "uoxqk.kampongflowers.com", "kampongflowers.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Antivirus Engine Signature Updates via WSUS/SCCM
MsMpEng.exe, CSPService.exe) running under the SYSTEM or specific AV-Admin service accounts, specifically when communicating with internal WSUS servers or approved update distribution points.Security Information and Event Management (SIEM) Content Refresh
ansible-playbook, puppet-agent) executing as a dedicated service account.Threat Hunting and IOC Validation Scripts