ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the IClickFix threat landscape, specifically targeting potential lateral movement or data exfiltration attempts within Azure Sentinel. Proactive hunting for these 33 IOCs is critical to identify early-stage intrusions and mitigate high-severity risks before they escalate into broader organizational impacts.

IOC Summary

Malware Family: IClickFix Total IOCs: 33 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	pidorsas.site	payload_delivery	2026-08-21	100%
domain	hulywali.space	payload_delivery	2026-08-21	100%
domain	zaerkos.rest	payload_delivery	2026-08-21	100%
domain	zaeroks.website	payload_delivery	2026-08-21	100%
domain	verokase.xyz	payload_delivery	2026-08-21	100%
domain	dad.adkfarmerdan.com	payload_delivery	2026-08-21	100%
domain	tomteboda1.se	payload_delivery	2026-08-21	100%
domain	ayesahrentacar.com	payload_delivery	2026-08-21	50%
domain	bellaneek.googlemydesign.com	payload_delivery	2026-08-21	50%
domain	nettbutikk.radiograf.no	payload_delivery	2026-08-21	50%
domain	susantperkins.clientsitedemo.com	payload_delivery	2026-08-21	50%
domain	huvipuistokeidas.fi	payload_delivery	2026-08-21	50%
domain	ideagallery.co	payload_delivery	2026-08-21	50%
domain	soprisengineering.com	payload_delivery	2026-08-21	50%
domain	rightwinmedias.com	payload_delivery	2026-08-21	50%
domain	bishnoivillagesafari.co.in	payload_delivery	2026-08-21	50%
domain	summershairbraidings.com	payload_delivery	2026-08-21	50%
domain	nobleeventsandrentals.com	payload_delivery	2026-08-21	50%
domain	twc-recruitment.co.za	payload_delivery	2026-08-21	50%
domain	thebestclean.ro	payload_delivery	2026-08-21	50%
domain	corporateventcatering.co.uk	payload_delivery	2026-08-21	50%
domain	coastalclearwaterdelivery.com	payload_delivery	2026-08-21	50%
domain	hilamode.com	payload_delivery	2026-08-21	50%
domain	lfsd423.com	payload_delivery	2026-08-21	50%
domain	cdevitsol.shop	payload_delivery	2026-08-21	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["pidorsas.site", "hulywali.space", "zaerkos.rest", "zaeroks.website", "verokase.xyz", "dad.adkfarmerdan.com", "tomteboda1.se", "ayesahrentacar.com", "bellaneek.googlemydesign.com", "nettbutikk.radiograf.no", "susantperkins.clientsitedemo.com", "huvipuistokeidas.fi", "ideagallery.co", "soprisengineering.com", "rightwinmedias.com", "bishnoivillagesafari.co.in", "summershairbraidings.com", "nobleeventsandrentals.com", "twc-recruitment.co.za", "thebestclean.ro", "corporateventcatering.co.uk", "coastalclearwaterdelivery.com", "hilamode.com", "lfsd423.com", "cdevitsol.shop", "neoventiveinc.com", "moveiseuropa.pt", "pte-sa.com", "fcmsafeservice.com", "spacelab.com.co", "windseyecapital.com", "bridgecosmeticsurgeryvacation.com", "safespacio.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — IClickFix

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: IClickFix IOCs detection rule:

• Scenario 1: Automated Service Account Scans by Enterprise Antivirus

  • Context: The enterprise endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs scheduled integrity scans on the IClickFix installation directory (C:\Program Files\iClickFix). During these scans, the AV engine may generate network traffic or file access events that match specific IOCs within the IClickFix threat package, particularly if the service account runs under a generic system identity.
  • Suggested Filter/Exclusion: Create an exclusion rule in the detection logic to ignore alerts where the Source User is NT SERVICE\iClickFixService or SYSTEM, and the Process Name matches iClickFixAgent.exe running within the standard installation path. Additionally, exclude traffic originating from the internal IP range of the AV management server if it triggers a network-based IOC.

• Scenario 2: Scheduled Data Synchronization with Central Repository

  • Context: IClickFix utilizes a scheduled job (configured in Windows Task Scheduler) to synchronize ticket data and knowledge base updates with the central repository every hour at :05 minutes. This synchronization involves outbound HTTPS connections to known IClickFix cloud endpoints that are listed in the 33 IOCs, potentially triggering “Outbound Connection to Known IOC” alerts during peak business hours.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 08:00 and 18:00 on weekdays where the Destination Port is 443 and the Destination Domain matches the official IClickFix CDN domains (e.g., *.iclickfix.com). Alternatively, whitelist the specific scheduled task name “i