ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or lateral movement within the environment. The SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify and contain potential threats before they escalate into broader security incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["mon-blanc-02.cfd", "timelevel12.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Backup Jobs on Service Accounts

  • Context: The IClickFix-Backup service account runs a nightly PowerShell script to archive ticket data. This process initiates outbound HTTPS connections to IClickFix cloud endpoints (e.g., api.iclickfix.com) which match the rule’s IOCs, triggering alerts during the maintenance window (02:00–04:00 UTC).
  • Suggested Filter/Exclusion: Create a time-based exclusion for the specific service account SID (S-1-5-21-...-BackupSvc) between 02:00 and 04:00 daily. Alternatively, filter out events where the ProcessName is powershell.exe and the parent process is TaskScheduler.exe.

• Scenario: Endpoint Management Tool (Intune/SCCM) Updates

  • Context: Microsoft Intune or SCCM pushes a configuration update to all workstations. The IClickFix client agent (IClickFix.Agent.exe) receives this push and establishes a connection to the IClickFix management server for policy synchronization, generating traffic that matches the detection IOCs on standard user workstations.
  • Suggested Filter/Exclusion: Exclude events where the ParentProcessName is Microsoft.IntuneManagementAgent.exe or ccmexec.exe. Additionally, filter out alerts originating from the specific IP subnet dedicated to the Endpoint Management infrastructure (e.g., 10.20.50.0/24).

• Scenario: Admin Manual Ticket Creation via Browser

  • Context: Helpdesk administrators frequently access the IClickFix web portal (`https