ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt targets the presence of known IClickFix indicators, which are frequently used to exploit user trust in legitimate software interfaces to execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary establishes persistence or exfiltrates data, mitigating the high severity risk associated with this social engineering attack vector.

IOC Summary

Malware Family: IClickFix Total IOCs: 8 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["rug.betweenthebunz.co", "remoteitprofessional.com", "ialphai.com", "interface.bf", "ivanoski.tech", "mamont.com.ua", "mghirealty.com", "moomalsalonspa.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a GUI-based installer (e.g., winget, choco, or a custom MSI) that internally invokes cmd.exe or powershell.exe to execute setup scripts or register COM objects, which may match the specific command-line patterns or process creation chains associated with IClickFix.

  • Filter/Exclusion: Exclude events where the parent process is a known installer executable (e.g., msiexec.exe, winget.exe, choco.exe) or where the command line contains standard installer flags like /i, /qn, or --install.

• Scenario: An IT administrator runs a PowerShell script to audit or clean up temporary files, using Get-ChildItem or Remove-Item against the %TEMP% or %APPDATA% directories, which might trigger detections if the script name or path matches an IOC (e.g., a script named setup.ps1 or install.ps1 located in a user profile).

  • Filter/Exclusion: Exclude PowerShell executions where the script path resides in standard administrative directories (e.g., C:\Scripts, C:\AdminTools) or where the parent process is powershell.exe launched by a scheduled task with a known GUID associated with maintenance jobs.

• Scenario: A user installs a legitimate browser extension or plugin that includes a native helper executable or a background service, which may be signed by a known vendor but placed in a location like %LOCALAPPDATA% or %PROGRAMFILES%, potentially matching file path or hash IOCs if the vendor is not on the trusted list.

  • Filter/Exclusion: Exclude file creation or process start events where the digital signature is valid and the signer matches a trusted vendor list (e.g., Microsoft, Adobe, Oracle, or specific internal CA certificates), or