This hunt detects adversary activity linked to the ClearFake campaign by identifying matches against a curated set of 47 Indicators of Compromise (IOCs) known to be used in their operations. Proactive hunting for these specific IOCs within Azure Sentinel is critical due to the high severity of the threat, enabling early identification and containment of potential ClearFake intrusions before they escalate into broader compromises.
Malware Family: ClearFake Total IOCs: 47 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | ubxcwu.goindigostudio.com | payload_delivery | 2026-08-01 | 100% |
| domain | fqibjme.globallatedeals.com | payload_delivery | 2026-08-01 | 100% |
| domain | jnsp5pfi.fishersace.com | payload_delivery | 2026-08-01 | 100% |
| domain | 3ezvsan5.ferkrueda.com | payload_delivery | 2026-08-01 | 100% |
| domain | ewlrqd.gnarcoticexoticz.com | payload_delivery | 2026-08-01 | 100% |
| domain | brzygpu.glennscarcare.com | payload_delivery | 2026-08-01 | 100% |
| domain | glennscarcare.com | payload_delivery | 2026-08-01 | 100% |
| domain | mon-banana-06.cfd | botnet_cc | 2026-08-01 | 90% |
| domain | lwyxxg.g-fitathletics.com | payload_delivery | 2026-08-01 | 100% |
| domain | nnudyll.gilfordvillagenurseryschool.com | payload_delivery | 2026-08-01 | 100% |
| domain | xwmuyy.getpumpedli.org | payload_delivery | 2026-08-01 | 100% |
| domain | getpumpedli.org | payload_delivery | 2026-08-01 | 100% |
| domain | uxqlomf.ghpprofessionalpaintingllc.com | payload_delivery | 2026-08-01 | 100% |
| domain | ghpprofessionalpaintingllc.com | payload_delivery | 2026-08-01 | 100% |
| domain | ee0xfh5z.certifiedairbalanceinlosangelesca.com | payload_delivery | 2026-08-01 | 100% |
| domain | ojbsqt.german-uboats.com | payload_delivery | 2026-08-01 | 100% |
| domain | xxhxsl.german-uboats.com | payload_delivery | 2026-08-01 | 100% |
| domain | iftuxuh.fencescapeinc.com | payload_delivery | 2026-08-01 | 100% |
| domain | mppxtrz.fencescapeinc.com | payload_delivery | 2026-08-01 | 100% |
| domain | ykiwcg.german-uboats.com | payload_delivery | 2026-08-01 | 100% |
| domain | german-uboats.com | payload_delivery | 2026-08-01 | 100% |
| domain | genevievesasseville.com | payload_delivery | 2026-08-01 | 100% |
| domain | nvftww.tashabeautystore.com | payload_delivery | 2026-08-01 | 100% |
| domain | dqktojj.federationofpbos.org | payload_delivery | 2026-08-01 | 100% |
| domain | gmsjsk15.salpizzasewell.com | payload_delivery | 2026-08-01 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["ubxcwu.goindigostudio.com", "fqibjme.globallatedeals.com", "jnsp5pfi.fishersace.com", "3ezvsan5.ferkrueda.com", "ewlrqd.gnarcoticexoticz.com", "brzygpu.glennscarcare.com", "glennscarcare.com", "mon-banana-06.cfd", "lwyxxg.g-fitathletics.com", "nnudyll.gilfordvillagenurseryschool.com", "xwmuyy.getpumpedli.org", "getpumpedli.org", "uxqlomf.ghpprofessionalpaintingllc.com", "ghpprofessionalpaintingllc.com", "ee0xfh5z.certifiedairbalanceinlosangelesca.com", "ojbsqt.german-uboats.com", "xxhxsl.german-uboats.com", "iftuxuh.fencescapeinc.com", "mppxtrz.fencescapeinc.com", "ykiwcg.german-uboats.com", "german-uboats.com", "genevievesasseville.com", "nvftww.tashabeautystore.com", "dqktojj.federationofpbos.org", "gmsjsk15.salpizzasewell.com", "ks52m3wi.apmlandscaping.com", "zxumfw.rsfoodproducts.com", "vszptzu.elcornerderaulmorote.com", "coronapd.org", "mmuq9r9o.liberty--token.com", "rvgitkx.eventmanagementindia.com", "ydlyns.libartytoken.com", "lvvbnf3q.angelnailsphenix.com", "plxxxru.elpatronrestaurantbar.com", "cnatia.lebertytoken.com", "dgmnroa.elpatronrestaurantbar.com", "ekjnnh.lebertytoken.com", "eloakoa.crownconnectpk.com", "pjeobx.jadoou.lat", "oofnjcu.floatservicesnw.com", "floatservicesnw.com", "mgluob.friendsofdormontlibrary.net", "friendsofdormontlibrary.net", "l1twkhat.valleychimneyrepair.com", "jldrbcv.fitprotracker-campaign.com", "zgzyob.freemanframeca.com", "freemanframeca.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: Security Information and Event Management (SIEM) Ingestion of Threat Intelligence Feeds
svc-siem-ingest or Splunk-Forwarder) when the source IP matches the internal threat intelligence gateway IP range, provided no network lateralization is observed.Scenario: Scheduled Endpoint Protection Policy Updates
DefenderUpdate task) pushes a global policy update containing the latest ClearFake signature pack to all endpoints. This triggers detection on the management server and agent nodes as they download and validate the IOCs.C:\Program Files\Microsoft Defender\MsMpEng.exe or CrowdStrike Falcon Sensor Service (Process ID 1) running under a dedicated system account (SYSTEM or svc-antivirus) during the maintenance window hours (e.g., 02:00 – 04:00 UTC).Scenario: Automated Vulnerability Scanning and Remediation