ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hypothesis targets the IClickFix attack vector, where adversaries exploit browser clickjacking to execute malicious code via hidden iframes, often leading to the deployment of infostealers or remote access trojans. Proactively hunting for these specific IOCs in Azure Sentinel is critical because this technique bypasses traditional user awareness by leveraging trusted browser interfaces, allowing attackers to establish a foothold in user sessions before standard endpoint detections can trigger.

IOC Summary

Malware Family: IClickFix Total IOCs: 4 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - IClickFix
let malicious_ips = dynamic(["85.239.147.30"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["85.239.147.30"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["fallow-willow-diogdaiyn.xyz", "immersionzone.info", "mytds1029380.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Scenario: Automated UI Automation Frameworks

  • Context: Enterprise applications using Python pyautogui or C# System.Windows.Forms for automated testing or RPA (Robotic Process Automation) bots that programmatically simulate mouse clicks and keyboard inputs.
  • Filter/Exclusion: Exclude processes where the parent is a known automation framework (e.g., python.exe, dotnet.exe, node.exe) AND the command line contains keywords like --headless, --automation, or --test. Alternatively, exclude if the process is running under a service account (e.g., svc_automation) rather than an interactive user.

• Scenario: Legacy Java Applet or Swing Applications

  • Context: Older internal line-of-business (LOB) applications built with Java Swing or AWT that rely on java.awt.Robot or similar APIs to handle UI interactions, which may trigger low-level input hooking or click simulation behaviors.
  • Filter/Exclusion: Exclude processes where the executable is java.exe or javaw.exe AND the working directory or command line references a known internal application path (e.g., C:\Apps\InternalERP\). Ensure the Java version is below a certain threshold if the IOC is version-specific.

• Scenario: Screen Recording and Collaboration Tools

  • Context: Tools like OBS Studio, Zoom, Teams, or Loom that use global input hooks to detect user activity for “activity detection” features (e.g., pausing recording when the user is idle) or to capture keyboard/mouse events for remote assistance.
  • Filter/Exclusion: Exclude processes where the executable name matches known collaboration/recording tools (obs64.exe, zoom.exe, ms-teams.exe, loom.exe) AND the process has