ThreatFox: IClickFix IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts within the organization’s ecosystem. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly validate potential compromises and mitigate risks associated with compromised third-party integrations before they escalate into broader security incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["bolerkas.shop", "pokarse.online", "bolerkas.sbs"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are the specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule:

• Scheduled Maintenance & Patching Jobs

  • Scenario: The enterprise utilizes a centralized patch management system (e.g., Microsoft Endpoint Configuration Manager or WSUS) that automatically deploys updates to all IClickFix agents during off-hours. These scheduled jobs trigger the IOCs as they download and install new agent versions, mimicking the behavior of an active threat deployment.
  • Filter/Exclusion: Create a time-based exclusion for the rule execution window (e.g., 02:00 – 04:00 UTC) or add a specific process filter to exclude WUAHandler.exe and ccmsetup.exe when they initiate connections to known IClickFix update endpoints.

• Help Desk Ticket Resolution Workflows

  • Scenario: When an end-user submits a complex ticket requiring remote assistance, the IClickFix Agent automatically launches a background service (icfixagent.exe) to scan system health and deploy specific scripts or tools (like Sysinternals Suite utilities) requested by the Service Desk team. This legitimate script execution triggers the IOCs associated with tool deployment.
  • Filter/Exclusion: Implement a logic filter that excludes alerts where the parent process is icfixagent.exe AND the user context belongs to the “HelpDesk” or “ServiceAccount” group, specifically when the action type is marked as “Scheduled Script Execution.”

• Automated Onboarding of New Hardware

  • Scenario: During the provisioning phase for new employee laptops managed via Microsoft Intune, the IClickFix agent is installed and immediately performs a full system inventory. This initial handshake involves multiple network calls and file writes that match the detection logic for IOCs, often occurring in bulk