ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel telemetry against 49 specific Indicators of Compromise (IOCs) linked to the ClearFake malware family. Proactively hunting for these IOCs allows the SOC team to identify early-stage infections and potential lateral movement before the threat escalates, ensuring rapid containment within the cloud environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 49 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	xwkfjnri.wyattsgreenhouse.com	payload_delivery	2026-07-23	100%
domain	wyattsgreenhouse.com	payload_delivery	2026-07-23	100%
domain	fuse5logicway.plasmagridunit.garden	botnet_cc	2026-07-23	90%
domain	azzy.bossynailspa.com	payload_delivery	2026-07-23	100%
domain	62ukoitn.thetokestudio.com	payload_delivery	2026-07-23	100%
domain	bossynailspa.com	payload_delivery	2026-07-23	100%
domain	heatmeshbase.plasmagridunit.garden	botnet_cc	2026-07-23	90%
domain	zldtgwwp.brj-contracting.com	payload_delivery	2026-07-23	100%
domain	vuee.betpool.online	payload_delivery	2026-07-23	100%
domain	brj-contracting.com	payload_delivery	2026-07-23	100%
domain	betpool.online	payload_delivery	2026-07-23	100%
domain	obsh.bondbrandingco.com	payload_delivery	2026-07-23	100%
domain	ldwv.bestnailsalonmedford.com	payload_delivery	2026-07-23	100%
domain	bestnailsalonmedford.com	payload_delivery	2026-07-23	100%
domain	mirt.bondbrandingco.com	payload_delivery	2026-07-23	100%
domain	bondbrandingco.com	payload_delivery	2026-07-23	100%
domain	qhin.bodyliciousllc.com	payload_delivery	2026-07-23	100%
domain	bodyliciousllc.com	payload_delivery	2026-07-23	100%
domain	s7uz9nrn.rayeganmarket.com	payload_delivery	2026-07-23	100%
domain	flow9taskunit.plasmagridunit.garden	botnet_cc	2026-07-23	90%
domain	hckc.blueexorcistchapters.com	payload_delivery	2026-07-23	100%
domain	dvhg.bestbusinessvoice.com	payload_delivery	2026-07-23	100%
domain	bestbusinessvoice.com	payload_delivery	2026-07-23	100%
domain	blueexorcistchapters.com	payload_delivery	2026-07-23	100%
domain	iesandresperezserrano.org	payload_delivery	2026-07-23	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["xwkfjnri.wyattsgreenhouse.com", "wyattsgreenhouse.com", "fuse5logicway.plasmagridunit.garden", "azzy.bossynailspa.com", "62ukoitn.thetokestudio.com", "bossynailspa.com", "heatmeshbase.plasmagridunit.garden", "zldtgwwp.brj-contracting.com", "vuee.betpool.online", "brj-contracting.com", "betpool.online", "obsh.bondbrandingco.com", "ldwv.bestnailsalonmedford.com", "bestnailsalonmedford.com", "mirt.bondbrandingco.com", "bondbrandingco.com", "qhin.bodyliciousllc.com", "bodyliciousllc.com", "s7uz9nrn.rayeganmarket.com", "flow9taskunit.plasmagridunit.garden", "hckc.blueexorcistchapters.com", "dvhg.bestbusinessvoice.com", "bestbusinessvoice.com", "blueexorcistchapters.com", "iesandresperezserrano.org", "spark2zonebox.xenonraypoint.garden", "verifyrecapcha.info", "nrxs.becoquin.org", "zesv.blossomnigeria.com", "becoquin.org", "blossomnigeria.com", "aeiq.becoffeecompany.com", "lkka.blackwaterpaintandbodyllc.com", "becoffeecompany.com", "blackwaterpaintandbodyllc.com", "sxid.basicwhitegirlforgunrights.com", "basicwhitegirlforgunrights.com", "esed.bahiacafehotelsalvador.com", "bahiacafehotelsalvador.com", "6biioqya.vitalmcallen.com", "vitalmcallen.com", "krabochel.pro", "authorization-id-browser.info", "0co7tx46.worldofmacarons.com", "raypathlink.xenonraypoint.garden", "verification.beer", "worldofmacarons.com", "navj.blackriverlawn.com", "blackriverlawn.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including specific triggers and recommended filters:

• Scenario 1: Scheduled Antivirus Definition Updates via Windows Update

  • Trigger: The enterprise’s endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) automatically downloads and installs new definition packs. These updates often contain hash signatures that overlap with the ClearFake IOCs, particularly when the update server distributes a patch known to be associated with the ClearFake campaign infrastructure.
  • Filter/Exclusion: Create an exclusion rule for processes running under the C:\Program Files\Microsoft Defender Antivirus or C:\ProgramData\CrowdStrike directories that match the specific IOCs during standard maintenance windows (e.g., 02:00–04:00 local time).

• Scenario 2: Admin-Initiated Security Tool Deployment via SCCM/Intune

  • Trigger: System Administrators deploy new security agents or configuration scripts using Microsoft Endpoint Configuration Manager (SCCM) or Intune. During the deployment phase, the installation package extracts temporary files that match ClearFake IOCs before the agent fully initializes and registers its own exclusions.
  • Filter/Exclusion: Exclude alerts generated by service accounts such as DOMAIN\SCCM-Deploy-Svc or DOMAIN\Intune-Auto-Pilot when the source process is ccmsetup.exe or Microsoft.IntuneManagementAgent.

• Scenario 3: Automated Backup Jobs Utilizing Cloud Storage

  • Trigger: Enterprise backup solutions (e.g., Veeam, Rubrik, or Azure Backup) perform scheduled incremental backups. The backup agent creates temporary staging files in network shares that contain metadata or embedded certificates matching the ClearFake IOCs, triggering a hit during the data ingestion phase.