← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-21T11:00:01Z · Confidence: high

Hunt Hypothesis

This hunt targets adversary behavior involving the ClearFake malware family by correlating network and endpoint telemetry against a curated set of 34 known Indicators of Compromise (IOCs). Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify early-stage infections or lateral movement attempts before they escalate into full-blown incidents.

IOC Summary

Malware Family: ClearFake Total IOCs: 34 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainorangefarmersmarket.orgpayload_delivery2026-07-21100%
domainoyawba10.site-asli-bedon-filter-1xbet.compayload_delivery2026-07-21100%
domainlufry.mabelsnursery.compayload_delivery2026-07-21100%
domainmabelsnursery.compayload_delivery2026-07-21100%
domainayhd.opulentbeautybarllc.compayload_delivery2026-07-21100%
domainopulentbeautybarllc.compayload_delivery2026-07-21100%
domainhbsgb.lunabybodyshaping.compayload_delivery2026-07-21100%
domainlunabybodyshaping.compayload_delivery2026-07-21100%
domaintwhhp.lucymflowers.compayload_delivery2026-07-21100%
domaincyyf.nurtured-in-nature.compayload_delivery2026-07-21100%
domainnurtured-in-nature.compayload_delivery2026-07-21100%
domainlucymflowers.compayload_delivery2026-07-21100%
domain87jcg6w8.everestpointnorthglenn.orgpayload_delivery2026-07-21100%
domainzbklcsro.jadoou.latpayload_delivery2026-07-21100%
domainv23ewcsy.calculadoracomisiones.compayload_delivery2026-07-21100%
domaindrrobertoiturralde.compayload_delivery2026-07-21100%
domaineverestpointnorthglenn.orgpayload_delivery2026-07-21100%
domaincjdl.nspowdercoatingnj.compayload_delivery2026-07-21100%
domainnspowdercoatingnj.compayload_delivery2026-07-21100%
domainmhuhx.longhornlodgemo.compayload_delivery2026-07-21100%
domainxbzh.kafekarachi.compayload_delivery2026-07-21100%
domainlonghornlodgemo.compayload_delivery2026-07-21100%
domaingbgl.kafekarachi.compayload_delivery2026-07-21100%
domainqbmuv.loganlooneyresume.compayload_delivery2026-07-21100%
domainloganlooneyresume.compayload_delivery2026-07-21100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["orangefarmersmarket.org", "oyawba10.site-asli-bedon-filter-1xbet.com", "lufry.mabelsnursery.com", "mabelsnursery.com", "ayhd.opulentbeautybarllc.com", "opulentbeautybarllc.com", "hbsgb.lunabybodyshaping.com", "lunabybodyshaping.com", "twhhp.lucymflowers.com", "cyyf.nurtured-in-nature.com", "nurtured-in-nature.com", "lucymflowers.com", "87jcg6w8.everestpointnorthglenn.org", "zbklcsro.jadoou.lat", "v23ewcsy.calculadoracomisiones.com", "drrobertoiturralde.com", "everestpointnorthglenn.org", "cjdl.nspowdercoatingnj.com", "nspowdercoatingnj.com", "mhuhx.longhornlodgemo.com", "xbzh.kafekarachi.com", "longhornlodgemo.com", "gbgl.kafekarachi.com", "qbmuv.loganlooneyresume.com", "loganlooneyresume.com", "tmnpc.lnlsealcoating.com", "lnlsealcoating.com", "7wzfqmf9.behtarin-site-shartbandi.com", "ynwe.jetourmexico.com", "mqljf.newcoservicemower.com", "newcoservicemower.com", "ewmc.jenslittlerugrats.org", "jpsym.mystic-brews.com", "mystic-brews.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/