This hypothesis targets the presence of ClearFake IOCs, a high-severity threat often associated with credential theft and web-based attacks, to identify compromised assets or active intrusions. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect and isolate affected systems before adversaries can leverage them for lateral movement or data exfiltration.
Malware Family: ClearFake Total IOCs: 31 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | e555kh1c.belly--flush.com | payload_delivery | 2026-09-20 | 100% |
| domain | digitalwithkaviya.wasmer.app | payload_delivery | 2026-09-20 | 90% |
| domain | 3wtbnee7.en-belly--flush.com | payload_delivery | 2026-09-20 | 100% |
| domain | datajapan.global | payload_delivery | 2026-09-20 | 90% |
| domain | 23568fdq.mosbatsms.ir | payload_delivery | 2026-09-20 | 100% |
| url | hxxps://testingcf.jsdelivr.net/gh/Boycshop/98D8-7A-2E-6A6F/sjhfjhgr465739fhg | payload_delivery | 2026-09-20 | 100% |
| domain | usa-synadentix.us | payload_delivery | 2026-09-20 | 100% |
| url | hxxps://testingcf.jsdelivr.net/gh/Boycshop/98D8-7A-2E-6A6F/C-48-51-97-89 | payload_delivery | 2026-09-20 | 100% |
| domain | oncemarketing.top | payload_delivery | 2026-09-20 | 90% |
| url | hxxps://testingcf.jsdelivr.net/gh/Pasquarenmjn/5C5B-9D-6C-7906/84F67A-7C-9F91 | payload_delivery | 2026-09-20 | 100% |
| domain | oeypy5hw.en-en--cardioslim.com | payload_delivery | 2026-09-20 | 100% |
| domain | pdksm65t.paripalse.com | payload_delivery | 2026-09-20 | 100% |
| domain | avsn5e1u.cia-churchinaction.org | payload_delivery | 2026-09-20 | 100% |
| domain | cia-churchinaction.org | payload_delivery | 2026-09-20 | 100% |
| domain | paripalse.com | payload_delivery | 2026-09-20 | 100% |
| domain | s6paj79n.en-en--enerflow.com | payload_delivery | 2026-09-20 | 100% |
| domain | xbat6pkv.ziqianzhang.com | payload_delivery | 2026-09-20 | 100% |
| domain | ziqianzhang.com | payload_delivery | 2026-09-20 | 100% |
| domain | zqyjau8o.melbetofficial.in | payload_delivery | 2026-09-20 | 100% |
| domain | melbetofficial.in | payload_delivery | 2026-09-20 | 100% |
| domain | tsgrecordsco.com | payload_delivery | 2026-09-20 | 90% |
| domain | a32uqtcs.nurvealive.com | payload_delivery | 2026-09-20 | 100% |
| domain | ttoryhwh.en-bizopp.com | payload_delivery | 2026-09-20 | 100% |
| domain | windowsdiag-service.pw | payload_delivery | 2026-09-19 | 90% |
| domain | rrvik8wj.worldofsnakes.org | payload_delivery | 2026-09-19 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["e555kh1c.belly--flush.com", "digitalwithkaviya.wasmer.app", "3wtbnee7.en-belly--flush.com", "datajapan.global", "23568fdq.mosbatsms.ir", "usa-synadentix.us", "oncemarketing.top", "oeypy5hw.en-en--cardioslim.com", "pdksm65t.paripalse.com", "avsn5e1u.cia-churchinaction.org", "cia-churchinaction.org", "paripalse.com", "s6paj79n.en-en--enerflow.com", "xbat6pkv.ziqianzhang.com", "ziqianzhang.com", "zqyjau8o.melbetofficial.in", "melbetofficial.in", "tsgrecordsco.com", "a32uqtcs.nurvealive.com", "ttoryhwh.en-bizopp.com", "windowsdiag-service.pw", "rrvik8wj.worldofsnakes.org", "worldofsnakes.org", "dqd5eykr.persianeducation.ir", "evz9hzhn.bonuscode.in", "bonuscode.in", "qo4bt10s.www-tupitea.com", "reisnrb.nl"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://testingcf.jsdelivr.net/gh/Boycshop/98D8-7A-2E-6A6F/sjhfjhgr465739fhg", "https://testingcf.jsdelivr.net/gh/Boycshop/98D8-7A-2E-6A6F/C-48-51-97-89", "https://testingcf.jsdelivr.net/gh/Pasquarenmjn/5C5B-9D-6C-7906/84F67A-7C-9F91"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A security operations team deploys a new threat intelligence feed integration (e.g., via Cortex XSOAR or Splunk SOAR) that automatically ingests the “ClearFake” IOC list from ThreatFox to enrich logs or create correlation rules. The ingestion process may temporarily write these IOCs to a staging directory or database, triggering the hunt if the rule scans file systems or memory for these specific strings/hashes.
C:\Program Files\Cortex\, C:\opt\soar\staging\) or exclude processes known to be the ingestion agent (e.g., xsoar-agent.exe, splunkd.exe during config sync).Scenario: A DevOps or Security Engineering team is performing a “chaos engineering” or red team simulation exercise where they intentionally deploy benign test files or containers that mimic the ClearFake IOCs to validate detection coverage. These test artifacts are often placed in temporary directories or specific test namespaces in Kubernetes/EKS.
C:\temp\redteam-sim\, /var/tmp/chaos-eng/) or exclude container images tagged with sim- or test- prefixes in Kubernetes environments.Scenario: An endpoint detection and response (EDR) agent or anti-malware tool (e.g., CrowdStrike Falcon, SentinelOne) performs a full system scan or on-access scan. During this process, it may load IOC definitions into memory or create temporary cache files containing the ClearFake IOCs to compare against active processes, potentially triggering memory-based or file-based detections.
FalconSensor.exe, `SentinelOne