ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the IClickFix threat ecosystem, which may signal potential supply chain compromises or targeted phishing campaigns. Proactively hunting for these specific IOCs within Azure Sentinel is critical to identify early-stage intrusions and mitigate risks before they escalate into broader organizational incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 77 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	mississippicannabisschool.com	payload_delivery	2026-08-23	100%
domain	oraclepacificltd.com	payload_delivery	2026-08-23	100%
domain	productstudio.me	payload_delivery	2026-08-23	100%
domain	psicologialorenalonso.es	payload_delivery	2026-08-23	100%
domain	sergiomarquesillustration.com	payload_delivery	2026-08-23	100%
domain	smec.group	payload_delivery	2026-08-23	100%
domain	tabrettbethell.info	payload_delivery	2026-08-23	100%
domain	talktostoppand.shop	payload_delivery	2026-08-23	100%
domain	thamyresheros.com	payload_delivery	2026-08-23	100%
domain	thinkomdigital.com	payload_delivery	2026-08-23	100%
domain	vipseniorplacement.com	payload_delivery	2026-08-23	100%
domain	wellthyco.com	payload_delivery	2026-08-23	100%
domain	william-c[.]360elevate.co	payload_delivery	2026-08-23	100%
domain	zoechementerprise.com	payload_delivery	2026-08-23	100%
domain	agenciaarco.com.br	payload_delivery	2026-08-23	100%
domain	agenciadetraduccion.net	payload_delivery	2026-08-23	100%
domain	amkatextiles.com	payload_delivery	2026-08-23	100%
domain	bassprosurvey.store	payload_delivery	2026-08-23	100%
domain	corporaciongoldengroup.com	payload_delivery	2026-08-23	100%
domain	drhakanonur.com	payload_delivery	2026-08-23	100%
domain	drrhodrimartin.co.uk	payload_delivery	2026-08-23	100%
domain	hzindia.com	payload_delivery	2026-08-23	100%
domain	innovatransport.com	payload_delivery	2026-08-23	100%
domain	lockotronic.com	payload_delivery	2026-08-23	100%
domain	dollllar881122.icu	botnet_cc	2026-08-23	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["mississippicannabisschool.com", "oraclepacificltd.com", "productstudio.me", "psicologialorenalonso.es", "sergiomarquesillustration.com", "smec.group", "tabrettbethell.info", "talktostoppand.shop", "thamyresheros.com", "thinkomdigital.com", "vipseniorplacement.com", "wellthyco.com", "william-c.360elevate.co", "zoechementerprise.com", "agenciaarco.com.br", "agenciadetraduccion.net", "amkatextiles.com", "bassprosurvey.store", "corporaciongoldengroup.com", "drhakanonur.com", "drrhodrimartin.co.uk", "hzindia.com", "innovatransport.com", "lockotronic.com", "dollllar881122.icu", "strongerpi921.life", "thunderstopui912.life", "transcripcionespro.net", "vagusnerveresearch.com", "viasmonline.com", "visionremota.com", "volkswagen.co.ao", "vxcellent.com", "www.alnwickholidayhouse.co.uk", "www.ipivot.it", "www.mudanzasmundivan.com", "yaolmasaydi.com", "irvincap.com", "josephonetech.com", "love-coach.online", "moat55.com", "mydesq.com", "oldglorybus.com", "pixelpartnerdigital.com", "realestateoffplan.com", "saggang.com", "salonmarketing.ru", "staffanlandin.se", "thebestsellermethod.com", "theuncommonadventure.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:

• Scenario: Legitimate deployment of IClickFix updates via SCCM or Intune.

  • Context: During scheduled maintenance windows, the Endpoint Detection and Response (EDR) agent detects network connections to IClickFix update servers (e.g., iclickfix.com or specific CDN IPs) as part of a standard patching cycle managed by Microsoft Configuration Manager (SCCM).
  • Suggested Filter: Exclude traffic originating from the “Patch Management” service account (e.g., DOMAIN\SCCM-Admin) and restrict the rule to trigger only if the destination IP is not within the known IClickFix CIDR range defined in the enterprise DNS allowlist.

• Scenario: Scheduled automated health checks by the Service Desk team.

  • Context: A nightly PowerShell script running on a dedicated jump server (SRV-ITOPS) executes a query against the IClickFix API to verify ticket status synchronization, triggering network IOCs that mimic active user sessions.
  • Suggested Filter: Create an exclusion for the specific hostname SRV-ITOPS and filter out events where the process name is powershell.exe executing with the command line argument containing IClickFixHealthCheck.ps1.

• Scenario: User-initiated installation of the IClickFix desktop agent.

  • Context: When a new hire or a user onboarding to the Service Desk installs the IClickFix client application, the installer (Setup.exe from the IClickFix vendor) establishes multiple outbound connections to download configuration profiles and register the device with the central cloud console.
  • Suggested Filter: Exclude events where the process path matches C:\Program Files\IClickFix\Installer\ or