This hunt targets the IClickFix exploit, a prevalent social engineering technique that leverages browser clickjacking to execute arbitrary code and establish initial access without user interaction. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints before the adversary can deploy additional payloads or move laterally within the environment.
Malware Family: IClickFix Total IOCs: 76 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | www.briannacrawford.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.debrancheexpert.tv | payload_delivery | 2026-09-15 | 100% |
| domain | www.duegolficharter.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.epokaere.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.mechenene.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.newvillarental.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.norbagolf.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.thekindleaderpodcast.com | payload_delivery | 2026-09-15 | 100% |
| domain | www.visionsite.it | payload_delivery | 2026-09-15 | 100% |
| domain | xn--q3cxt4bxc8b.com | payload_delivery | 2026-09-15 | 100% |
| domain | ravsatexim.com | payload_delivery | 2026-09-15 | 100% |
| domain | reallifecommunityservices.com | payload_delivery | 2026-09-15 | 100% |
| domain | sakugavarskeks.ee | payload_delivery | 2026-09-15 | 100% |
| domain | sharjahtodip.com | payload_delivery | 2026-09-15 | 100% |
| domain | softgenics.net | payload_delivery | 2026-09-15 | 100% |
| domain | sonaxconsultancy.com | payload_delivery | 2026-09-15 | 100% |
| domain | styleperu.com | payload_delivery | 2026-09-15 | 100% |
| domain | talentslink.org | payload_delivery | 2026-09-15 | 100% |
| domain | truehealth.com.hk | payload_delivery | 2026-09-15 | 100% |
| domain | uni-ae.com | payload_delivery | 2026-09-15 | 100% |
| domain | upla.es | payload_delivery | 2026-09-15 | 100% |
| domain | vectorsofmassdestruction.com | payload_delivery | 2026-09-15 | 100% |
| domain | waahidtrading.com | payload_delivery | 2026-09-15 | 100% |
| domain | webkul.design | payload_delivery | 2026-09-15 | 100% |
| domain | www.adamabraham.co.uk | payload_delivery | 2026-09-15 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["www.briannacrawford.com", "www.debrancheexpert.tv", "www.duegolficharter.com", "www.epokaere.com", "www.mechenene.com", "www.newvillarental.com", "www.norbagolf.com", "www.thekindleaderpodcast.com", "www.visionsite.it", "xn--q3cxt4bxc8b.com", "ravsatexim.com", "reallifecommunityservices.com", "sakugavarskeks.ee", "sharjahtodip.com", "softgenics.net", "sonaxconsultancy.com", "styleperu.com", "talentslink.org", "truehealth.com.hk", "uni-ae.com", "upla.es", "vectorsofmassdestruction.com", "waahidtrading.com", "webkul.design", "www.adamabraham.co.uk", "www.arthholidays.com", "kuciel.com.pl", "ledys-architecte.com", "leezainternational.com", "macroautos.com.mx", "manhthang.net", "mesacontractingpa.com", "mizi.in", "mypaytech.de", "otoboyasizgocukduzeltme.com", "pepguides.com", "pmdmangoes.com", "positiveawards.co.uk", "pulsedocreliefcentre.com", "qualytecbrasil.com.br", "raolite.com", "dellacred.com.br", "designbrains.be", "drjanetlittlespeaks.com", "edwinlimclinic.sg", "enviroforest.com", "estacaoideia.com.br", "evobeaute.eu", "francismclaren.co.uk", "fresh-rx.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legacy Web Portal Maintenance: Administrators updating the JavaScript configuration for an internal HR or ERP portal (e.g., Workday, ServiceNow) may inadvertently include the specific onclick handler patterns or base64-encoded strings used in IClickFix if they are reusing old code snippets or testing click-tracking logic.
chrome.exe, msedge.exe, firefox.exe) and the command line contains keywords like --inspect, --remote-debugging-port, or --headless, or where the user account belongs to a WebAdmins or FrontendDev group.Third-Party Analytics/Tag Manager Deployment: When deploying or updating Google Tag Manager (GTM) or similar analytics scripts on corporate intranet sites, the injected JavaScript may contain obfuscated click-event handlers that match the IOCs, particularly if the vendor uses minified code that resembles the IClickFix payload structure.
10.20.1.0/24) and the process is iisexpress.exe or w3wp.exe (IIS worker process).Internal Click-Through Testing for UX Teams: User Experience (UX) researchers or QA engineers may use browser extensions or custom scripts to simulate user clicks and measure conversion rates on internal marketing pages. These tools often inject event listeners that can trigger the IOC-based detection if they use common obfuscation techniques.
UXResearch or QAEngineering group and the process is a browser with