ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by correlating network and endpoint telemetry against a specific set of 11 known Indicators of Compromise (IOCs). Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage infections and mitigate potential data exfiltration or lateral movement before the threat escalates.

IOC Summary

Malware Family: ClearFake Total IOCs: 11 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["iypuztg.tashabeautystore.com", "shlwsw.stmariapharmacy.com", "stmariapharmacy.com", "nbcfchw.tamajailroster.org", "tamajailroster.org", "switchspineprint.com", "0cppgosu.prairiefurnitureshop.com", "ajhgra.stephanie-bates.com", "stephanie-bates.com", "dlwkpdf.swirlscinnamonrolls.com", "swirlscinnamonrolls.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, along with targeted mitigation strategies:

• Scenario: Automated Endpoint Protection Updates

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint, which automatically downloads and installs definition updates. These updates often originate from IP addresses or hash signatures that overlap with the ClearFake IOC list, triggering alerts during nightly maintenance windows (e.g., 02:00–04:00).
  • Filter/Exclusion: Create a suppression rule excluding events where the Process Name matches FalconSensor.exe, MsMpEng.exe, or DefenderService.exe AND the event time falls within the defined maintenance window. Alternatively, add the specific update server IPs to a global allow-list.

• Scenario: Scheduled Third-Party Backup Jobs

  • Context: The organization runs nightly backups using Veeam Backup & Replication or Acronis Cyber Protect. These agents frequently communicate with cloud storage repositories (e.g., AWS S3, Azure Blob) that share network ranges or certificate fingerprints included in the ClearFake IOCs. This often triggers detections when backup jobs initiate large data transfers.
  • Filter/Exclusion: Implement a filter to exclude alerts where the Source Process is identified as VeeamAgent.exe, vbrservice.exe, or AcronisBackupService.exe. Additionally, whitelist the specific destination IP ranges of the cloud storage providers associated with these backup jobs.

• Scenario: Internal Software Deployment via SCCM/Intune

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune to push software patches and application installations to workstations. During mass deployments, the distribution points communicate with external repositories