ThreatFox: IClickFix IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal potential supply chain compromises or unauthorized access attempts. A proactive hunt is essential within Azure Sentinel to rapidly validate these high-severity signals and mitigate risks before they escalate into broader organizational incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["basecodereset.com", "approvalrequest-api.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Helpdesk Ticket Sync Job

  • Context: The nightly automated synchronization job running on the HelpDesk-Sync-01 server uses a PowerShell script to query the IClickFix API. This process generates network traffic matching the rule’s IOCs (specifically the API endpoint and associated certificate thumbprints).
  • Suggested Filter/Exclusion: Create an exclusion based on the source hostname (HelpDesk-Sync-01) and the specific scheduled task name IClickFix_Daily_Sync. Alternatively, filter out events where the process command line contains -SyncMode or the user context is a dedicated service account (e.g., svc_helpdesk_sync).

• Scenario: Admin Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During a quarterly update cycle, SCCM deploys the latest IClickFix agent version to 50+ workstations. The installation and post-installation registration trigger network connections that match the detection IOCs across multiple endpoints simultaneously.
  • Suggested Filter/Exclusion: Exclude alerts where the process name is ccmsetup.exe or msiexec.exe and the parent process is TaskHostW.exe. Additionally, apply a time-based filter to suppress alerts during known maintenance windows (e.g., Sundays between 02:00 and 06:00 UTC).

• Scenario: Active Directory Group Policy Agent Update

  • Context: The IClickFix agent is managed via Group Policy Objects (GPO). When the GPO refreshes, domain-joined machines initiate a connection to the IClickFix management server to verify configuration compliance, triggering the rule.