ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise from the IClickFix threat intelligence feed to identify potential malicious network connections or file executions within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel because early detection of high-severity threats allows for rapid containment before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["seal.369bbqsifangonline.com", "king.369bbqsifangonline.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule:

• Scenario: Scheduled Patching and Update Deployment

  • Context: The enterprise IT team runs a nightly scheduled task using Microsoft System Center Configuration Manager (SCCM) or Ansible to push updates to all endpoints. This process triggers the IClickFix update agent, which downloads patches and executes installation scripts matching the rule’s IOCs.
  • Filter/Exclusion: Exclude network traffic and process execution events originating from the specific SCCM management point IP range (e.g., 10.20.50.x) or filter out processes where the parent executable is ccmexec.exe or ansible-runner.

• Scenario: Automated Helpdesk Ticket Resolution

  • Context: The service desk utilizes an automated workflow in ServiceNow that triggers IClickFix agents to perform remote remediation (e.g., clearing temp files, restarting services) when a high-priority ticket is auto-resolved. This generates the specific IOCs associated with the agent’s background operations.
  • Filter/Exclusion: Create an exclusion rule for events where the user context matches the service account svc-iclickfix or where the command line arguments contain keywords like --auto-ticket-id.

• Scenario: Endpoint Security Integration Scans

  • Context: The organization’s primary EDR solution, such as CrowdStrike Falcon or SentinelOne, performs a deep integration scan with IClickFix to verify agent health and license compliance. This handshake process triggers the detection logic by mimicking the IOCs defined in the ThreatFox package.
  • Filter/Exclusion: Filter out alerts where the source process is FalconSensor.exe (CrowdStrike) or `SentinelOne