ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise from the IClickFix threat intelligence feed, which may signal active reconnaissance or initial access attempts within the environment. The SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify and contain potential threats before they escalate into broader incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - IClickFix
let malicious_ips = dynamic(["91.236.230.121", "149.56.95.163"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.236.230.121", "149.56.95.163"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule:

• Scenario: Scheduled Service Health Checks by the IClickFix Agent

  • Context: The native IClickFix agent (installed on endpoints via SCCM or Intune) performs automated daily health checks and connectivity tests against the central IClickFix server. These background processes often initiate outbound HTTPS connections to known IClickFix cloud domains, triggering network IOCs.
  • Filter/Exclusion: Create a rule exclusion for traffic originating from the IClickFixAgent.exe process (or specific service PID) connecting to known IClickFix FQDNs (e.g., *.iclickfix.com, api.iclickfix.com). Additionally, exclude traffic on standard ports 443 where the destination IP belongs to the ASN of the vendor.

• Scenario: Admin-Initiated “One-Click” Remediation Scripts

  • Context: IT administrators frequently use IClickFix’s “One-Click” feature to deploy immediate fixes (e.g., clearing temp files, restarting specific services) across a group of machines. This action triggers the agent to download configuration payloads and execute scripts that match the detection logic for script-based IOCs.
  • Filter/Exclusion: Exclude events where the User field matches members of the “IT Helpdesk” or “System Admins” security groups, specifically when the event source is tagged with the IClickFix application ID. Alternatively, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time) where bulk remediation jobs are scheduled.

• Scenario: Integration with Enterprise Ticketing Systems (ServiceNow/Jira)

  • Context: In many enterprises, IClickFix is integrated with ServiceNow or Jira