This hunt targets the execution of malicious payloads delivered via the IClickFix technique, where adversaries exploit browser clickjacking to trick users into running unauthorized scripts or downloads. Proactively hunting for these IOCs in Azure Sentinel is critical because IClickFix often bypasses traditional perimeter defenses, allowing attackers to establish a foothold through common user interactions with web-based applications.
Malware Family: IClickFix Total IOCs: 60 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | global-stash.beer | payload_delivery | 2026-09-06 | 100% |
| domain | coal.albaikmenuonline.com | payload_delivery | 2026-09-06 | 100% |
| domain | fxprovietnam.com | payload_delivery | 2026-09-06 | 75% |
| domain | fynqolo.site | payload_delivery | 2026-09-06 | 75% |
| domain | gaanwala.in | payload_delivery | 2026-09-06 | 75% |
| domain | franckformation-autoecole.fr | payload_delivery | 2026-09-06 | 75% |
| domain | fraternite-maranatha.com | payload_delivery | 2026-09-06 | 75% |
| domain | freakarts.com | payload_delivery | 2026-09-06 | 75% |
| domain | freedomparties.org | payload_delivery | 2026-09-06 | 75% |
| domain | freefly.co.jp | payload_delivery | 2026-09-06 | 75% |
| domain | frenchies.nyc | payload_delivery | 2026-09-06 | 75% |
| domain | freshaal.com | payload_delivery | 2026-09-06 | 75% |
| domain | friesenpferde-heydecke.de | payload_delivery | 2026-09-06 | 75% |
| domain | frogcake.net | payload_delivery | 2026-09-06 | 75% |
| domain | frosokompaniet.se | payload_delivery | 2026-09-06 | 75% |
| domain | frustratedtofree.com | payload_delivery | 2026-09-06 | 75% |
| domain | fullstaqpro.com | payload_delivery | 2026-09-06 | 75% |
| domain | funcyclop.com | payload_delivery | 2026-09-06 | 75% |
| domain | fundacionludovica.org.ar | payload_delivery | 2026-09-06 | 75% |
| domain | fundacionmaterluz.cl | payload_delivery | 2026-09-06 | 75% |
| domain | furmintusa.com | payload_delivery | 2026-09-06 | 75% |
| domain | fondationmonumentsromains.nimes.fr | payload_delivery | 2026-09-06 | 75% |
| domain | fondmama.com | payload_delivery | 2026-09-06 | 75% |
| domain | fonni.net | payload_delivery | 2026-09-06 | 75% |
| domain | foodhallpoland.pl | payload_delivery | 2026-09-06 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["global-stash.beer", "coal.albaikmenuonline.com", "fxprovietnam.com", "fynqolo.site", "gaanwala.in", "franckformation-autoecole.fr", "fraternite-maranatha.com", "freakarts.com", "freedomparties.org", "freefly.co.jp", "frenchies.nyc", "freshaal.com", "friesenpferde-heydecke.de", "frogcake.net", "frosokompaniet.se", "frustratedtofree.com", "fullstaqpro.com", "funcyclop.com", "fundacionludovica.org.ar", "fundacionmaterluz.cl", "furmintusa.com", "fondationmonumentsromains.nimes.fr", "fondmama.com", "fonni.net", "foodhallpoland.pl", "foodyone.com", "forgebridgetechnologies.com", "fortdemauvanne.fr", "fortisinsaatemlak.com", "fortmyersradon.com", "fotodiket.se", "fourzerogroup.com", "fpspoznan.pl", "fragskart.in", "frait.cz", "fitsaslp.com", "fizjomedicare.pl", "flamingo-accounting.co.uk", "flashblu.com", "flibonito.com", "flipphonestudios.com", "floorexpoanddesign.com", "floorplanbuilder.com", "flowers4joy.com", "flymingotech.in", "foca.se", "focustaepperoggulve.dk", "folksrecruit.com", "feuerwehr-hahndorf.de", "fiaddaroma.it"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A developer or DevOps engineer installs a legitimate cross-platform GUI framework (such as wxWidgets, Qt, or Electron) that bundles the iclickfix library or shares similar object names (e.g., IClickFix.dll, IClickFix.so) for event handling.
C:\Program Files\nodejs\node_modules\, C:\Users\<user>\.vscode\extensions\, C:\Program Files (x86)\Microsoft Visual Studio\) and filter by parent process being a known IDE or build tool (e.g., node.exe, msbuild.exe, code.exe).Scenario: An automated software update or patching tool (like Ansible, Chef, or Puppet) deploys a custom application or library that includes a component named iclickfix as part of a proprietary UI toolkit or third-party dependency.
AnsibleService, ChefClient, PuppetAgent) and exclude if the parent process is a known configuration management agent or if the file path resides in a designated application directory (e.g., C:\Program Files\MyApp\bin\).Scenario: A security team or IT admin manually downloads a test binary, POC (Proof of Concept), or sample file for analysis or training purposes, which happens to be named iclickfix.exe or contains the IOC string in its metadata.
C:\Temp\, C:\Users\<user>\Downloads\, `C:\Quar