This hunt identifies the presence of known IClickFix indicators, which are frequently used to exploit browser vulnerabilities and establish initial footholds through malicious click-to-run mechanisms. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect compromised endpoints before attackers can leverage the initial access to deploy additional malware or move laterally within the environment.
Malware Family: IClickFix Total IOCs: 64 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | www.snmechanicalhvac.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.teczkibezkwasowe.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.weilaizhijiao.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.wilsondrugs.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.wrongside.it | payload_delivery | 2026-09-16 | 100% |
| domain | talatatilla.com | payload_delivery | 2026-09-16 | 100% |
| domain | trueform.cn | payload_delivery | 2026-09-16 | 100% |
| domain | tvrepair.ae | payload_delivery | 2026-09-16 | 100% |
| domain | walterwaygood.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.bildhochdrei.at | payload_delivery | 2026-09-16 | 100% |
| domain | www.eliterisk.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.fairmounthomestaging.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.lambayecano.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.nanofotonica.it | payload_delivery | 2026-09-16 | 100% |
| domain | www.pharmafranchisemart.com | payload_delivery | 2026-09-16 | 100% |
| domain | www.piccadillybistrot.it | payload_delivery | 2026-09-16 | 100% |
| domain | www.smartlc.it | payload_delivery | 2026-09-16 | 100% |
| domain | muninn.nl | payload_delivery | 2026-09-16 | 100% |
| domain | ncoeorg.in | payload_delivery | 2026-09-16 | 100% |
| domain | pachocreate.com | payload_delivery | 2026-09-16 | 100% |
| domain | plasis-em.com | payload_delivery | 2026-09-16 | 100% |
| domain | prontohandymanllc.com | payload_delivery | 2026-09-16 | 100% |
| domain | skill-cert.com | payload_delivery | 2026-09-16 | 100% |
| domain | spairobeauty.com | payload_delivery | 2026-09-16 | 100% |
| domain | stepplumbing.com.au | payload_delivery | 2026-09-16 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["www.snmechanicalhvac.com", "www.teczkibezkwasowe.com", "www.weilaizhijiao.com", "www.wilsondrugs.com", "www.wrongside.it", "talatatilla.com", "trueform.cn", "tvrepair.ae", "walterwaygood.com", "www.bildhochdrei.at", "www.eliterisk.com", "www.fairmounthomestaging.com", "www.lambayecano.com", "www.nanofotonica.it", "www.pharmafranchisemart.com", "www.piccadillybistrot.it", "www.smartlc.it", "muninn.nl", "ncoeorg.in", "pachocreate.com", "plasis-em.com", "prontohandymanllc.com", "skill-cert.com", "spairobeauty.com", "stepplumbing.com.au", "sudewi.com", "supwithwade.com", "taazaproducts.com", "hoshizouen.co.jp", "innoventservices.com", "iocky.com", "klanbaatnagger.dk", "latacoyota.com", "lms-teckpia.com", "lomboktourbooking.com", "makerman.in", "mordemsanat.com.tr", "mrpiccam.com", "mrusinagem.com", "bucaramanga.consulado.gob.ve", "bunnybathco.com", "ckquilting.com", "cutfromvalor.com", "davariyabrothers.com", "elipse.health", "evisa-e-govkg.com", "flyersholding.com", "fullynsure.com", "geneparks.com", "greendrive.bg"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: An enterprise IT team deploys a custom PowerShell script via Group Policy or a configuration management tool (e.g., SCCM, Ansible) to standardize browser settings. The script explicitly sets the DefaultBrowser registry key or writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExes\.html to enforce a specific browser, which matches the IClickFix IOC for registry modifications associated with hijacking the default browser.
CcmExec.exe, T-Client.exe, Ansible.exe) or where the command line contains specific keywords like Set-ItemProperty targeting the FileExes path, provided the user is part of the IT_Administrators AD group.Scenario: A software vendor releases an update for their proprietary desktop application (e.g., a custom ERP client or CAD tool) that includes a post-install script to register file associations for specific file types (e.g., .xyz, .data). This script uses assoc or ftype commands or directly modifies registry keys to ensure the application opens these files by default, triggering the IOC for file association changes.
msiexec.exe, setup.exe, install.exe) from a trusted vendor path (e.g., C:\Program Files\VendorName\) and the user is in the Local Administrators group.Scenario: A security team runs a periodic “browser hygiene” check using a custom PowerShell script that iterates through user profiles to verify and reset the default browser to the corporate standard (e.g., Edge or Chrome). The script queries and potentially rewrites the UserChoice registry keys under