ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts within the organization’s ecosystem. A proactive search in Azure Sentinel is essential to identify early-stage threats associated with these high-severity IOCs before they escalate into broader security incidents affecting critical business operations.

IOC Summary

Malware Family: IClickFix Total IOCs: 4 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["tin.tokyo77hit.com", "piomilokao.icu", "vailora231.life"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://clickzona.net/embed/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:

• Scenario: Automated Helpdesk Ticket Synchronization via PowerShell

  • Context: The IT Service Management (ITSM) team runs a scheduled PowerShell script (Start-HelpdeskSync.ps1) on the domain controller every morning at 06:00 AM. This script queries the IClickFix API to sync ticket status and triggers outbound connections to api.iclickfix.com using the specific IOCs defined in the rule.
  • Filter/Exclusion: Create a detection exclusion for the specific process path C:\Scripts\ITSM\Start-HelpdeskSync.ps1 executing on the host group “Domain Controllers” during the time window 05:30–07:30 daily.

• Scenario: Endpoint Security Agent Communication

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. These agents periodically check the IClickFix integration module to update threat intelligence feeds, generating network traffic that matches the rule’s IOCs (e.g., specific User-Agent strings or destination IPs) from all managed workstations.
  • Filter/Exclusion: Exclude alerts where the initiating process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent for Defender) and the network destination port matches the standard IClickFix API ports (e.g., 443), provided the source host belongs to the “Managed Workstations” AD group.

• Scenario: Scheduled Backup Job Utilizing IClickFix Webhooks

  • Context: The backup solution, Veeam Backup & Replication, is configured to send status notifications and incident logs directly to the IClickFix platform via webhooks