ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt targets adversary activity involving known indicators of compromise from the IClickFix campaign to identify potential initial access or command-and-control communications within the environment. Proactive hunting for these specific IOCs in Azure Sentinel is critical because early detection allows the SOC team to rapidly isolate affected assets and prevent lateral movement before the threat escalates into a broader incident.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["charlesriverrecovery.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://leposeur.com/assets/js/bootstrap.bundle.min.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: IClickFix IOCs rule in an enterprise environment, including recommended filters or exclusions:

• Service Desk Ticketing System Integration

  • Scenario: The organization utilizes a third-party IT Service Management (ITSM) platform (e.g., ServiceNow, Jira Service Management, or Freshservice) that syncs asset data with the IClickFix mobile workforce application. During nightly synchronization jobs, the ITSM server initiates outbound HTTPS connections to the IClickFix API endpoints (api.iclickfix.com) and downloads asset manifests from specific IClickFix CDN domains.
  • Filter/Exclusion: Create a rule exclusion for the ServiceNow mid_server or Jira Service Management service account IP addresses when communicating with known IClickFix FQDNs. Alternatively, whitelist traffic on port 443 from these specific internal subnets to the IClickFix CIDR ranges identified in the IOC list.

• Endpoint Configuration Management (SCCM/Intune)

  • Scenario: The IT Operations team uses Microsoft Endpoint Configuration Manager (MECM/SCCM) or Microsoft Intune to deploy and update the IClickFix mobile agent across thousands of field technician devices. A scheduled deployment task triggers a background process (ccmexec.exe or IntuneManagementExtension) that queries IClickFix repositories for version manifests and policy updates, generating network traffic matching the rule’s IOCs.
  • Filter/Exclusion: Exclude processes running under the System account with specific executable paths (e.g., C:\Windows\CCM\* or C:\Program Files\Microsoft Intune Management Extension\*) when initiating connections to IClickFix domains. Ensure the exclusion is time-bound if these updates only occur during maintenance windows (e.g.,