ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts targeting this critical business application. Proactively hunting for these IOCs within Azure Sentinel is essential because early identification of IClickFix-related threats allows the SOC team to rapidly contain potential breaches before they escalate into significant operational disruptions.

IOC Summary

Malware Family: IClickFix Total IOCs: 3 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["fan.369bbqsifangonline.com", "dock.yourbodybydesign.me"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://cdn.jsdelivr.net/gh/Patricia-38674/ret74kfd98j/nam1o0tych"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule:

• Scenario 1: Scheduled Maintenance & Patching Jobs

  • Context: The enterprise utilizes a centralized patch management system (e.g., Microsoft Endpoint Configuration Manager or Ivanti) that runs nightly maintenance scripts. These jobs often trigger the IClickFix service to update its local agent configuration, download new policy definitions, and synchronize ticket data with the central server, generating network traffic matching the rule’s IOCs.
  • Suggested Filter: Exclude alerts where the source process is Ivanti.Agent.exe or SMS_EXECUTIVE.exe running under the SYSTEM account during defined maintenance windows (e.g., 01:00–04:00 local time).

• Scenario 2: Helpdesk Agent Installation & Onboarding

  • Context: During new employee onboarding, the IT Operations team deploys the IClickFix agent via Microsoft Intune or SCCM. The initial installation and first-time handshake with the IClickFix cloud service trigger a burst of outbound connections to known IOCs (e.g., iclickfix.com endpoints) as the agent registers its device ID and establishes secure tunnels.
  • Suggested Filter: Create an exclusion for hosts tagged with “New-Hardware” or “Onboarding-Active” in the asset management database, specifically filtering events where the event timestamp is within 24 hours of the Ivanti.Agent installation date.

• Scenario 3: Automated Ticket Synchronization via PowerShell

  • Context: The Service Desk team utilizes a custom PowerShell script (Sync-Tickets.ps1) scheduled via Windows Task Scheduler to pull high-priority tickets from the IClickFix portal every hour. This