This hunt detects adversary activity linked to the ClearFake campaign by monitoring for matches against a curated set of 56 specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical because ClearFake employs sophisticated fileless and living-off-the-land tactics that often evade standard signature-based defenses, requiring immediate investigation to prevent potential data exfiltration.
Malware Family: ClearFake Total IOCs: 56 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | swcosh.braindifender.us | payload_delivery | 2026-08-07 | 100% |
| domain | slaxbvv.audizenus.com | payload_delivery | 2026-08-07 | 100% |
| domain | audizenus.com | payload_delivery | 2026-08-07 | 100% |
| domain | digitalmarketingandadvertisingagency.com | payload_delivery | 2026-08-07 | 100% |
| domain | braindifender.us | payload_delivery | 2026-08-07 | 100% |
| domain | t622q131.therodeoroundup.com | payload_delivery | 2026-08-07 | 100% |
| domain | braindifender.com | payload_delivery | 2026-08-07 | 100% |
| domain | xtjcss.braindefendr.com | payload_delivery | 2026-08-07 | 100% |
| domain | dewa111.de.com | payload_delivery | 2026-08-07 | 100% |
| domain | rbuttt.braindefendr.com | payload_delivery | 2026-08-07 | 100% |
| domain | cgupvay.audizen-eng-usa.com | payload_delivery | 2026-08-07 | 100% |
| domain | braindefendr.com | payload_delivery | 2026-08-07 | 100% |
| domain | audizen-eng-usa.com | payload_delivery | 2026-08-07 | 100% |
| domain | hgdktvy.audeezen.com | payload_delivery | 2026-08-07 | 100% |
| domain | audeezen.com | payload_delivery | 2026-08-07 | 100% |
| domain | cpnazr.braindefendere.com | payload_delivery | 2026-08-07 | 100% |
| domain | braindefendere.com | payload_delivery | 2026-08-07 | 100% |
| domain | wik301dg.graphicstabletreviews.com | payload_delivery | 2026-08-07 | 100% |
| domain | dealertinleypark.com | payload_delivery | 2026-08-07 | 100% |
| domain | hkckpom.aoudizen.com | payload_delivery | 2026-08-07 | 100% |
| domain | aoudizen.com | payload_delivery | 2026-08-07 | 100% |
| domain | s1x30duk.spirosnet.com | payload_delivery | 2026-08-07 | 100% |
| domain | sfaofd.brain--defender.com | payload_delivery | 2026-08-07 | 100% |
| domain | brain--defender.com | payload_delivery | 2026-08-07 | 100% |
| domain | braindefender.com | payload_delivery | 2026-08-07 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["swcosh.braindifender.us", "slaxbvv.audizenus.com", "audizenus.com", "digitalmarketingandadvertisingagency.com", "braindifender.us", "t622q131.therodeoroundup.com", "braindifender.com", "xtjcss.braindefendr.com", "dewa111.de.com", "rbuttt.braindefendr.com", "cgupvay.audizen-eng-usa.com", "braindefendr.com", "audizen-eng-usa.com", "hgdktvy.audeezen.com", "audeezen.com", "cpnazr.braindefendere.com", "braindefendere.com", "wik301dg.graphicstabletreviews.com", "dealertinleypark.com", "hkckpom.aoudizen.com", "aoudizen.com", "s1x30duk.spirosnet.com", "sfaofd.brain--defender.com", "brain--defender.com", "braindefender.com", "achoxen.com", "qcxwddc.aaudizen.com", "rmawet.bp-zone.us", "mhvigyc.aaudizen.com", "aaudizen.com", "tziuge.bp-zone.us", "bp-zone.us", "864zcnq3.grannygshemporium.com", "dcozart.tsfrecords.com", "dxpzop.wakap21.xyz", "pdubvw.vitalmarkings.net", "rxgpfyy.vonshiprock.com", "6710ekqg.specialtypopupevents.com", "rdduwa.vistapropertyllc.com", "vkebuqp.uplandmealsonwheels.org", "yedwwl.turbo-course.com", "tcrmynh.univchristianchurch.com", "uhs3ppkp.spareing.com", "bisblj.visionfordsales.com", "mssbksu.overtheitgirl.com", "sx6qkomj.gamestwists.com", "gyayquk.drubenginecologo.com", "wxmqed.victoryshoescorp.com", "602a5sud.foodpapajobs.com", "vygjdt.trustcsbs.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:
Scenario: Security Operations Center (SOC) analysts manually ingesting threat intelligence feeds into the SIEM or EDR platform.
siem-ingestor.exe (e.g., Splunk Universal Forwarder) or threat-intel-sync.ps1, and the user context belongs to the “SOC-Admins” security group.Scenario: Scheduled automated vulnerability scanning jobs running against the enterprise network.
10.20.50.x) during the scheduled maintenance window (02:00 – 04:00 UTC), specifically filtering out processes named nessus.exe or qualys-cloud-agent.Scenario: Endpoint Detection and Response (EDR) agents performing signature database updates.