ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt targets the IClickFix exploit, a prevalent browser-based attack that leverages user interaction to execute malicious code without requiring a traditional vulnerability. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as this technique often bypasses traditional perimeter defenses and can lead to rapid lateral movement within the environment.

IOC Summary

Malware Family: IClickFix Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["authshipup.net", "runtimerailbit.com", "servicestatlab.com", "reed-greogzium.life"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a web application where the build process involves downloading and executing a JavaScript bundle or installer script from a public CDN or artifact repository that shares a hash or filename pattern with known IClickFix IOCs.
  • Filter/Exclusion: Exclude alerts where the parent process is a known build agent (e.g., java.exe for Jenkins, node.exe for npm, or docker.exe) and the file path resides within a standard build workspace directory (e.g., C:\jenkins\workspace\ or /home/gitlab-runner/builds/).
• Scenario: An IT administrator runs a legacy line-of-business application or a custom internal tool that utilizes a shared DLL or executable named iclick.dll or click.exe for UI interaction handling, which matches the IOC filename or hash.
  • Filter/Exclusion: Exclude alerts for specific known-good file paths (e.g., C:\Program Files\InternalApp\bin\iclick.dll) or add a trusted hash exclusion for the specific SHA256 of the legitimate internal binary after verification.
• Scenario: A security team performs a controlled penetration test or red team exercise that intentionally deploys IClickFix payloads to validate detection coverage, triggering the rule as expected but generating noise in the SOC queue.
  • Filter/Exclusion: Implement a tagging mechanism in the SIEM where alerts from hosts with the tag PenTest or RedTeam are routed to a separate queue or auto-suppressed during scheduled test windows.
• Scenario: A user installs a legitimate third-party browser extension or plugin (e.g., for ad-blocking or developer tools) that includes a component with a filename or hash matching an IClickFix IOC, often due to generic naming conventions in open-source