This hypothesis targets the IClickFix exploit, which leverages browser vulnerabilities to execute arbitrary code and establish persistence on user endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised hosts early, as this technique often bypasses traditional perimeter defenses and can lead to significant lateral movement and data exfiltration.
Malware Family: IClickFix Total IOCs: 33 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | www.noithatotolaocai.com | payload_delivery | 2026-09-14 | 100% |
| domain | www.robloxfruit.site | payload_delivery | 2026-09-14 | 100% |
| domain | www.vieclamuytin.com | payload_delivery | 2026-09-14 | 100% |
| domain | zafirasasha.com | payload_delivery | 2026-09-14 | 100% |
| domain | mthnomex.com | payload_delivery | 2026-09-14 | 100% |
| domain | nslegends.com | payload_delivery | 2026-09-14 | 100% |
| domain | ofahmitowing.com | payload_delivery | 2026-09-14 | 100% |
| domain | plumbing215.com | payload_delivery | 2026-09-14 | 100% |
| domain | prestigegaragecare.com | payload_delivery | 2026-09-14 | 100% |
| domain | privatehub.icu | payload_delivery | 2026-09-14 | 100% |
| domain | rafaelsotto.com | payload_delivery | 2026-09-14 | 100% |
| domain | ratehive.co | payload_delivery | 2026-09-14 | 100% |
| domain | reeshapk.com | payload_delivery | 2026-09-14 | 100% |
| domain | thehempfatherus.com | payload_delivery | 2026-09-14 | 100% |
| domain | vetstudents.eu | payload_delivery | 2026-09-14 | 100% |
| domain | vorcis.com | payload_delivery | 2026-09-14 | 100% |
| domain | come-chop.com | payload_delivery | 2026-09-14 | 100% |
| domain | dheeradigitech.in | payload_delivery | 2026-09-14 | 100% |
| domain | dialoguesummit.com | payload_delivery | 2026-09-14 | 100% |
| domain | dom-inn.de | payload_delivery | 2026-09-14 | 100% |
| domain | expertsverdict.org | payload_delivery | 2026-09-14 | 100% |
| domain | gamoratalks.com | payload_delivery | 2026-09-14 | 100% |
| domain | jennmp.com | payload_delivery | 2026-09-14 | 100% |
| domain | kenmosavillage.com | payload_delivery | 2026-09-14 | 100% |
| domain | kianshimisepanta.com | payload_delivery | 2026-09-14 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["www.noithatotolaocai.com", "www.robloxfruit.site", "www.vieclamuytin.com", "zafirasasha.com", "mthnomex.com", "nslegends.com", "ofahmitowing.com", "plumbing215.com", "prestigegaragecare.com", "privatehub.icu", "rafaelsotto.com", "ratehive.co", "reeshapk.com", "thehempfatherus.com", "vetstudents.eu", "vorcis.com", "come-chop.com", "dheeradigitech.in", "dialoguesummit.com", "dom-inn.de", "expertsverdict.org", "gamoratalks.com", "jennmp.com", "kenmosavillage.com", "kianshimisepanta.com", "leadsrecovery.com", "affinitycollectivetravel.com", "aihjo.com", "arlingtongaragedoorinc.com", "autocitypeninsula.com", "bazarbd.xyz", "candidlykaite.com", "codiwaves.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A security team deploys a YARA rule or Sigma logon package to detect IClickFix artifacts (e.g., specific registry keys like HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons or file paths in %TEMP%) across the fleet using a configuration management tool like Ansible or Chef. The deployment script creates temporary files or modifies registry keys during the execution phase, matching the IOC patterns before cleanup.
ansible-service-runner.exe, chef-client.exe, psexec.exe) or where the user context is a dedicated service account (e.g., DOMAIN\svc-config) rather than an interactive user.Scenario: An IT administrator performs a manual test of the IClickFix mitigation by intentionally triggering the exploit in a controlled sandbox or using a test script that downloads a benign payload to %TEMP% and registers a shell icon override to verify detection coverage. The test leaves residual artifacts in the registry or file system that match the IOCs.
%TEMP%\iclickfix-test\) if the test script uses a consistent naming convention.Scenario: A third-party application installer (e.g., Adobe Creative Cloud, Zoom, or Slack) uses a custom installer that temporarily writes configuration files or registry entries to HKCU\Software\... or %TEMP% that coincidentally match the string patterns of the IClickFix IOCs (e.g., generic names like config.dat or update.exe in temporary paths).