ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving known malicious indicators from the IClickFix threat intelligence feed to identify potential compromises within the Azure Sentinel environment. The SOC team should proactively search for these IOCs because their high severity rating suggests an immediate risk of active threats that could evade standard automated detections if not explicitly investigated.

IOC Summary

Malware Family: IClickFix Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["iocriotao.icu", "triapfog.com", "mioiooo.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Backup Jobs on File Servers

  • Context: Enterprise file servers (e.g., Windows Server 2019/2022) often run nightly backup jobs using tools like Veeam Backup & Replication or Rubrik. These agents may generate network traffic or process execution signatures that match the IClickFix IOCs, particularly if they utilize similar hashing algorithms or communication ports.
  • Filter/Exclusion: Create a filter to exclude alerts where the Source Host belongs to the “File-Server” OU and the Process Name matches known backup agents (e.g., Veeam.Backup.Service.exe, rubrik-agent.exe). Additionally, restrict the rule trigger to business hours only if backups are strictly scheduled outside this window.

• Scenario: Automated Patch Deployment via SCCM

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push updates and scripts to endpoints. During a mass deployment, the distribution points may download IClickFix-related packages or trigger script executions that mimic the IOCs defined in the rule, causing high-volume alerts during maintenance windows.
  • Filter/Exclusion: Implement an exclusion based on User Account identity. Exclude any events generated by the system account NT SERVICE\CCMService or specific service accounts like svc-patch-deploy. Alternatively, add a time-based filter to suppress alerts during the defined “Maintenance Window” (e.g., Sundays 02:00–06:00).

• Scenario: Third-Party RMM Tool Integration

  • Context: The organization utilizes a Remote Monitoring and Management (R