This hunt detects adversary activity by correlating Azure Sentinel logs against a curated set of 101 Indicators of Compromise (IOCs) linked to the ClearFake malware family. Proactively hunting for these specific IOCs is critical because ClearFake’s sophisticated evasion techniques often bypass standard signature-based defenses, requiring manual investigation to identify early-stage infections and prevent lateral movement within the environment.
Malware Family: ClearFake Total IOCs: 101 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | futurevisionme.com | payload_delivery | 2026-07-27 | 50% |
| domain | fadyghali.com | payload_delivery | 2026-07-27 | 50% |
| domain | menoracarpet.com | payload_delivery | 2026-07-27 | 50% |
| domain | manjilas.com | payload_delivery | 2026-07-27 | 50% |
| domain | inagj.ch | payload_delivery | 2026-07-27 | 50% |
| domain | vidrosprovetro.com.br | payload_delivery | 2026-07-27 | 50% |
| domain | barrettbrokers.com | payload_delivery | 2026-07-27 | 50% |
| domain | nochef.org | payload_delivery | 2026-07-27 | 50% |
| domain | mikemalatesta.com | payload_delivery | 2026-07-27 | 50% |
| domain | aprendoencasa.org | payload_delivery | 2026-07-27 | 50% |
| domain | news4gujarati.com | payload_delivery | 2026-07-27 | 50% |
| domain | newyorkimmigration.ca | payload_delivery | 2026-07-27 | 50% |
| domain | sartikamotor.co.id | payload_delivery | 2026-07-27 | 50% |
| domain | cmdgl.ro | payload_delivery | 2026-07-27 | 50% |
| domain | therapywithpurpose.net | payload_delivery | 2026-07-27 | 50% |
| domain | appliedcontrols.in | payload_delivery | 2026-07-27 | 50% |
| domain | banahealth.care | payload_delivery | 2026-07-27 | 50% |
| domain | cledor-conseils.com | payload_delivery | 2026-07-27 | 50% |
| domain | solaric.com.ph | payload_delivery | 2026-07-27 | 50% |
| domain | dongyangmotors.co.kr | payload_delivery | 2026-07-27 | 50% |
| domain | aesuppressors.com | payload_delivery | 2026-07-27 | 50% |
| domain | centrudauneauto.ro | payload_delivery | 2026-07-27 | 50% |
| domain | cledor-experts.com | payload_delivery | 2026-07-27 | 50% |
| domain | growingleaders.com | payload_delivery | 2026-07-27 | 50% |
| domain | ktco-co.ir | payload_delivery | 2026-07-27 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["futurevisionme.com", "fadyghali.com", "menoracarpet.com", "manjilas.com", "inagj.ch", "vidrosprovetro.com.br", "barrettbrokers.com", "nochef.org", "mikemalatesta.com", "aprendoencasa.org", "news4gujarati.com", "newyorkimmigration.ca", "sartikamotor.co.id", "cmdgl.ro", "therapywithpurpose.net", "appliedcontrols.in", "banahealth.care", "cledor-conseils.com", "solaric.com.ph", "dongyangmotors.co.kr", "aesuppressors.com", "centrudauneauto.ro", "cledor-experts.com", "growingleaders.com", "ktco-co.ir", "edenads.com", "adyalaelectronics.pk", "sketchworks.co.za", "soleo-info.com", "alambiodiversitasindonesia.or.id", "jmsoluciones.com.ar", "krullung.hu", "liveshowsmerchandising.com", "thebeekman.com", "jeewanjee.com", "imed.asia", "eletroarparacatu.com.br", "arttv.gr", "nexunews.com", "fastfixcars.com", "anikadigital.com", "904jaxlatino.com", "bestcryptosignals.io", "freshnewtracks.com", "alwifakclub.com", "partyartsok.hu", "bmsmigration.com", "clocktowerhighered.com", "bss.edu.pk", "omarakitchencabinets.genxe.pk"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ClearFake IOCs detection rule:
Endpoint Security Console Updates: The organization’s primary endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads threat intelligence feeds from ClearFake to update its local signature database. This triggers a network connection to ClearFake IOCs during scheduled maintenance windows.
falcon.sys / MsMpEng.exe.SIEM Threat Intelligence Ingestion: The enterprise SIEM platform (e.g., Splunk Enterprise Security or Sentinel) runs a daily automated job to ingest and parse new IOCs from the ClearFox feed via an API connector. This results in high-volume traffic matching the 101 IOCs during data ingestion cycles.
splunk-connect.exe or sentinel-agent).Security Orchestration & Automated Response: The SOAR platform (e.g., Palo Alto XSOAR or Tenable.io) executes a scheduled playbook that queries ClearFake IOCs to enrich incident tickets. This generates legitimate traffic when the system checks for new indicators against current alerts.