← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-10T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against a curated set of 26 Indicators of Compromise (IOCs) specific to the ClearFake malware campaign. Proactive hunting for these IOCs is essential to identify early-stage infections and potential lateral movement, enabling rapid containment before the threat escalates within the enterprise environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 26 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainnynashanti.chpayload_delivery2026-08-1090%
domainskrfpet.en-us-ignitraa.compayload_delivery2026-08-10100%
domainen-us-ignitraa.compayload_delivery2026-08-10100%
domaincahnzr.prosta--vive.uspayload_delivery2026-08-10100%
domainzfeodhb.en-us-goldaligns.compayload_delivery2026-08-10100%
domainen-us-goldaligns.compayload_delivery2026-08-10100%
domainauthorljmatin.compayload_delivery2026-08-1090%
domainuhfazu.tiroalpaloes.copayload_delivery2026-08-10100%
domainvolrko.probotnet_cc2026-08-10100%
domainucooyac.enus-goldalign.compayload_delivery2026-08-10100%
domainstimmt.chpayload_delivery2026-08-1090%
domainigxpbym.enus-goldalign.compayload_delivery2026-08-10100%
domainen-en-synaptign.compayload_delivery2026-08-10100%
domaindqfqjllc.elcornerderaulmorote.compayload_delivery2026-08-10100%
domainenskbzl.enus-goldalign.compayload_delivery2026-08-10100%
domainenus-goldalign.compayload_delivery2026-08-10100%
domainsqq7n7q0.eng-en-slimsounds.compayload_delivery2026-08-10100%
domainxpeidl.spirosnet.compayload_delivery2026-08-10100%
domainrypqfjc.greenestreetchurch.compayload_delivery2026-08-10100%
domain7ve71wpr.eng-neuroxen.compayload_delivery2026-08-10100%
domainhhhazm.shop-gutdrops.compayload_delivery2026-08-10100%
domainkjwhklm.greenestreetchurch.compayload_delivery2026-08-10100%
domain4i3lqas7.en-us-en-prostawive.compayload_delivery2026-08-10100%
domainlahtbx.shop-digestistart.compayload_delivery2026-08-10100%
domainnoiojjl.greaternewzionbc.orgpayload_delivery2026-08-10100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["nynashanti.ch", "skrfpet.en-us-ignitraa.com", "en-us-ignitraa.com", "cahnzr.prosta--vive.us", "zfeodhb.en-us-goldaligns.com", "en-us-goldaligns.com", "authorljmatin.com", "uhfazu.tiroalpaloes.co", "volrko.pro", "ucooyac.enus-goldalign.com", "stimmt.ch", "igxpbym.enus-goldalign.com", "en-en-synaptign.com", "dqfqjllc.elcornerderaulmorote.com", "enskbzl.enus-goldalign.com", "enus-goldalign.com", "sqq7n7q0.eng-en-slimsounds.com", "xpeidl.spirosnet.com", "rypqfjc.greenestreetchurch.com", "7ve71wpr.eng-neuroxen.com", "hhhazm.shop-gutdrops.com", "kjwhklm.greenestreetchurch.com", "4i3lqas7.en-us-en-prostawive.com", "lahtbx.shop-digestistart.com", "noiojjl.greaternewzionbc.org", "mzpdgxi.graphicstabletreviews.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/