ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts. The SOC team should proactively investigate these signals in Azure Sentinel to identify early-stage threats and mitigate potential risks associated with compromised third-party integrations before they escalate into significant incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 6 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - IClickFix
let malicious_ips = dynamic(["85.192.31.214"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["85.192.31.214"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["mortilostart.com", "costum342183.life", "secretpi88122.life", "ajnfqs.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://mortilostart.com/5qdS7Aq.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:

• Scheduled Helpdesk Ticket Sync via PowerShell

  • Scenario: The IT Service Management team runs a nightly PowerShell script (Sync-Tickets.ps1) on the domain controller to pull ticket data from the IClickFix cloud API. This script establishes outbound HTTPS connections to known IClickFix endpoints, triggering the rule when it matches specific IOCs related to telemetry or API ingestion.
  • Filter/Exclusion: Exclude traffic where the source process is powershell.exe (or specifically the script path) and the destination IP belongs to the IClickFix CIDR block 104.x.x.x, provided the connection occurs between 02:00 and 04:00 UTC.

• Endpoint Management Agent Health Checks

  • Scenario: The enterprise utilizes Microsoft Endpoint Configuration Manager (SCCM) or Intune to manage IClickFix desktop agents. These agents perform periodic health checks and configuration updates by contacting the IClickFix management server, generating network flows that match the detection’s IOCs for agent heartbeat signals.
  • Filter/Exclusion: Create a whitelist exclusion for source processes named IcfAgent.exe or IntuneManagementExtension.exe, ensuring the rule does not alert on these specific executables regardless of destination port (typically 443).

• IT Admin Manual Troubleshooting Sessions

  • Scenario: During business hours, IT administrators frequently log into the IClickFix web portal via Microsoft Edge or Chrome to manually investigate complex tickets. If an admin opens a specific diagnostic tool within the browser that fetches real-time logs from the IClickFix backend, this user-initiated traffic can trigger the IOC match.
  • Filter/Exclusion: Implement