← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-31T11:00:00Z · Confidence: high

Hunt Hypothesis

This detection rule identifies adversary behavior where ClearFake malware establishes initial access and executes data exfiltration activities using known Indicators of Compromise (IOCs). A SOC team should proactively hunt for these specific IOCs in Azure Sentinel to rapidly detect early-stage infections and prevent sensitive data loss before the threat escalates.

IOC Summary

Malware Family: ClearFake Total IOCs: 29 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainelsfpng.classicpontiac.orgpayload_delivery2026-07-31100%
domainclassicpontiac.orgpayload_delivery2026-07-31100%
domainbxzpts.aurinebeverly.compayload_delivery2026-07-31100%
domainvideogeo.rupayload_delivery2026-07-3150%
domainchestnutstanza.topbotnet_cc2026-07-3150%
domainaurinebeverly.compayload_delivery2026-07-31100%
domainconsumersupporthelpline.co.ukpayload_delivery2026-07-31100%
domain0lt9m77b.roundtheclockcare.netpayload_delivery2026-07-31100%
domainfrenlvq.citycompanies-dev.netpayload_delivery2026-07-31100%
domaincitycompanies-dev.netpayload_delivery2026-07-31100%
domainoboizw.atriplejranch.compayload_delivery2026-07-31100%
domainatriplejranch.compayload_delivery2026-07-31100%
domain6oybqhpt.coachandkitchen.compayload_delivery2026-07-31100%
domaincoachandkitchen.compayload_delivery2026-07-31100%
domainnqgikft.chevyrepairhuntingtonbeach.compayload_delivery2026-07-31100%
domainchevyrepairhuntingtonbeach.compayload_delivery2026-07-31100%
domaindhatfu.apmlandscaping.compayload_delivery2026-07-31100%
domainapmlandscaping.compayload_delivery2026-07-31100%
domainiwffn03j.eastonfootandanklecenter.compayload_delivery2026-07-31100%
domaineastonfootandanklecenter.compayload_delivery2026-07-31100%
domainlbsmduw.certifiedairbalanceinlosangelesca.compayload_delivery2026-07-31100%
domaincertifiedairbalanceinlosangelesca.compayload_delivery2026-07-31100%
domainzsupeg.angelnailsphenix.compayload_delivery2026-07-31100%
domainangelnailsphenix.compayload_delivery2026-07-31100%
domainmrdughl.cannesresidencia.compayload_delivery2026-07-31100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["elsfpng.classicpontiac.org", "classicpontiac.org", "bxzpts.aurinebeverly.com", "videogeo.ru", "chestnutstanza.top", "aurinebeverly.com", "consumersupporthelpline.co.uk", "0lt9m77b.roundtheclockcare.net", "frenlvq.citycompanies-dev.net", "citycompanies-dev.net", "oboizw.atriplejranch.com", "atriplejranch.com", "6oybqhpt.coachandkitchen.com", "coachandkitchen.com", "nqgikft.chevyrepairhuntingtonbeach.com", "chevyrepairhuntingtonbeach.com", "dhatfu.apmlandscaping.com", "apmlandscaping.com", "iwffn03j.eastonfootandanklecenter.com", "eastonfootandanklecenter.com", "lbsmduw.certifiedairbalanceinlosangelesca.com", "certifiedairbalanceinlosangelesca.com", "zsupeg.angelnailsphenix.com", "angelnailsphenix.com", "mrdughl.cannesresidencia.com", "cannesresidencia.com", "kvetkoms.smallshopsandwhatknot.com", "dfojjm.angebagnia.com", "angebagnia.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs rule, tailored for a legitimate enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/