This hunt targets the presence of 48 known IOCs associated with the ClearFake malware family, which is frequently deployed to compromise web applications and establish persistent backdoors. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised assets early, preventing attackers from leveraging these footholds for lateral movement or data exfiltration within the cloud environment.
Malware Family: ClearFake Total IOCs: 48 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | oo1cjsjt.pura--boost.us | payload_delivery | 2026-09-06 | 100% |
| domain | www.confrariacorporativa.com.br | payload_delivery | 2026-09-06 | 90% |
| domain | clovislawgroup.com | payload_delivery | 2026-09-06 | 90% |
| domain | changeitupchangemanagement.com | payload_delivery | 2026-09-06 | 90% |
| domain | changeitupchangemanagement.com.au | payload_delivery | 2026-09-06 | 90% |
| domain | chateaudesuz.com | payload_delivery | 2026-09-06 | 90% |
| domain | bl0kfp6v.us-en-us-nervealive.com | payload_delivery | 2026-09-06 | 100% |
| domain | cellebrationmia.com | payload_delivery | 2026-09-06 | 90% |
| domain | cestiecalici.com | payload_delivery | 2026-09-06 | 90% |
| domain | tvdpamxr.us-usa-memorylift.com | payload_delivery | 2026-09-06 | 100% |
| domain | cascadechristmas.com | payload_delivery | 2026-09-06 | 90% |
| domain | cheapcanna.site | payload_delivery | 2026-09-06 | 90% |
| domain | zad672je.us-theeloncode.com | payload_delivery | 2026-09-06 | 100% |
| domain | 6rxe52vn.us-us-us-biodentix.com | payload_delivery | 2026-09-06 | 100% |
| domain | us-us-us-biodentix.com | payload_delivery | 2026-09-06 | 100% |
| domain | www.bruceandgina.com | payload_delivery | 2026-09-06 | 90% |
| domain | canteiro-online.com.br | payload_delivery | 2026-09-06 | 90% |
| domain | caissiescoular.com | payload_delivery | 2026-09-06 | 90% |
| domain | bule6swiss.com | payload_delivery | 2026-09-06 | 90% |
| domain | caficulturadepanama.org | payload_delivery | 2026-09-06 | 90% |
| domain | buxair.co.za | payload_delivery | 2026-09-06 | 90% |
| domain | bsv-kapfenberg.at | payload_delivery | 2026-09-06 | 90% |
| domain | calicanna.shop | payload_delivery | 2026-09-06 | 90% |
| domain | bomadental.com.br | payload_delivery | 2026-09-06 | 90% |
| domain | bolcag.com | payload_delivery | 2026-09-06 | 90% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["oo1cjsjt.pura--boost.us", "www.confrariacorporativa.com.br", "clovislawgroup.com", "changeitupchangemanagement.com", "changeitupchangemanagement.com.au", "chateaudesuz.com", "bl0kfp6v.us-en-us-nervealive.com", "cellebrationmia.com", "cestiecalici.com", "tvdpamxr.us-usa-memorylift.com", "cascadechristmas.com", "cheapcanna.site", "zad672je.us-theeloncode.com", "6rxe52vn.us-us-us-biodentix.com", "us-us-us-biodentix.com", "www.bruceandgina.com", "canteiro-online.com.br", "caissiescoular.com", "bule6swiss.com", "caficulturadepanama.org", "buxair.co.za", "bsv-kapfenberg.at", "calicanna.shop", "bomadental.com.br", "bolcag.com", "brainspikemarketing.com", "black-forest-trading.com", "boutique.vn", "www.body-project-tunisia.com", "www.bodrumhayvanmezarligi.com", "blackmountainsg.com", "bohemianpostcards.com", "bluemakers.net", "www.bishopsglass.co.uk", "br2z.com", "www.bracipizza.com", "www.biziexpress.com", "bondibilala.com", "l1pi06sr.us-us-usa-lipovive.com", "us-us-usa-lipovive.com", "baseebook.com", "bieffe.org", "www.bigtonypoker.com", "bflyarn.com", "www.bestforme.net", "www.bettingspeak.com", "benigoldikoyi.com", "www.b-vitrees.fr"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a new version of a microservice that includes a specific binary hash or IP address from the ClearFake IOC list as part of a legitimate dependency or configuration file.
jenkins-agent.exe, gitlab-runner.exe) or where the parent process is a build tool (e.g., docker.exe, kubectl.exe).Scenario: An endpoint protection platform (EPP) like CrowdStrike Falcon or Microsoft Defender for Endpoint performs a scheduled integrity scan or policy sync, temporarily writing or touching files that match the ClearFake IOCs (e.g., specific file paths or hashes) during its update cycle.
FalconSensor.exe, MsMpEng.exe) or where the action is a “Read” or “Scan” rather than “Create” or “Execute.”Scenario: A network monitoring tool (e.g., Wireshark, Zeek, or a custom Python script) captures and logs traffic, and the log analysis process creates temporary files or connections that match the ClearFake IP or URL IOCs because the tool is inspecting known test traffic or benchmark data.
wireshark.exe, tshark.exe, python.exe with a specific script path) or where the destination IP is in a known internal test subnet range.Scenario: A system administrator runs a manual vulnerability scan using a tool like Nessus or Qualys, which probes specific ports or URLs associated with the ClearFake IOCs to verify