ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of known ClearFake indicators of compromise, which are frequently leveraged by threat actors to establish persistence or execute malicious payloads within Azure environments. Proactively searching for these IOCs allows the SOC team to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: ClearFake Total IOCs: 33 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
domain	`nld9qz8u.en-us-glycofree.com`	payload_delivery	2026-09-19	100%
domain	`rd6k97w3.shop-burnflow.com`	payload_delivery	2026-09-19	100%
domain	`hqqpi58b.en-xenburn.com`	payload_delivery	2026-09-19	100%
domain	`scottcurdiephotography.com`	payload_delivery	2026-09-19	90%
url	`hxxps://testingcf.jsdelivr.net/gh/Boycshop/DC-0A-E1-4E-E0-05/04EC49-812B67`	payload_delivery	2026-09-19	100%
domain	`bsdsvltx.libertytokan.com`	payload_delivery	2026-09-19	100%
domain	`usa-neurovera.us`	payload_delivery	2026-09-19	100%
url	`hxxps://testingcf.jsdelivr.net/gh/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/22274659-87`	payload_delivery	2026-09-19	100%
domain	`pjilctsx.enus-metabodrops.com`	payload_delivery	2026-09-19	100%
domain	`awilli.co.uk`	payload_delivery	2026-09-19	90%
domain	`3nblpdw2.enus-flashburn.com`	payload_delivery	2026-09-19	100%
domain	`enus-flashburn.com`	payload_delivery	2026-09-19	100%
url	`hxxps://testingcf.jsdelivr.net/gh/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/dgfyrte-98`	payload_delivery	2026-09-19	100%
domain	`lobby09.co.il`	payload_delivery	2026-09-19	90%
domain	`mgbkbp4b.enus-tupitea.com`	payload_delivery	2026-09-19	100%
domain	`www.sestitoedilservice.it`	payload_delivery	2026-09-19	90%
domain	`farmtasticdoggy.com.au`	payload_delivery	2026-09-19	90%
domain	`kodg0fih.palmdriverv.com`	payload_delivery	2026-09-19	100%
domain	`wmicconfidance.info`	payload_delivery	2026-09-19	90%
domain	`x1m07e7w.enus-metabodrops.com`	payload_delivery	2026-09-19	100%
domain	`uat.edu.course.movest.co`	payload_delivery	2026-09-19	90%
domain	`uxahadmx.kaarenorge.com`	payload_delivery	2026-09-19	100%
domain	`2gp421dm.en-us-en-smartwaterbox.com`	payload_delivery	2026-09-19	100%
domain	`en-us-en-smartwaterbox.com`	payload_delivery	2026-09-19	100%
domain	`00rr59n2.en-pegasus.com`	payload_delivery	2026-09-19	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["nld9qz8u.en-us-glycofree.com", "rd6k97w3.shop-burnflow.com", "hqqpi58b.en-xenburn.com", "scottcurdiephotography.com", "bsdsvltx.libertytokan.com", "usa-neurovera.us", "pjilctsx.enus-metabodrops.com", "awilli.co.uk", "3nblpdw2.enus-flashburn.com", "enus-flashburn.com", "lobby09.co.il", "mgbkbp4b.enus-tupitea.com", "www.sestitoedilservice.it", "farmtasticdoggy.com.au", "kodg0fih.palmdriverv.com", "wmicconfidance.info", "x1m07e7w.enus-metabodrops.com", "uat.edu.course.movest.co", "uxahadmx.kaarenorge.com", "2gp421dm.en-us-en-smartwaterbox.com", "en-us-en-smartwaterbox.com", "00rr59n2.en-pegasus.com", "membres.encouplesimone.com", "qb51hxxp.burn--flow.com", "okr768ai.theslimsplitsmethod.com", "m2jml0yu.en-xenburn.com", "c5kwvkoh.greenestreetchurch.com", "www.icalicenseuk.freebusinessdebtrecovery.com", "belser-immo.ch", "vy2f0f2a.josephmichaelnh.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://testingcf.jsdelivr.net/gh/Boycshop/DC-0A-E1-4E-E0-05/04EC49-812B67", "https://testingcf.jsdelivr.net/gh/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/22274659-87", "https://testingcf.jsdelivr.net/gh/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/dgfyrte-98"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — ClearFake

False Positive Guidance

Scenario: A security engineer or DevOps team is manually validating the IOC list by copying and pasting the 33 ClearFake indicators into a SIEM query builder, a threat intelligence platform (e.g., MISP, Cortex), or a script for enrichment.
- Filter/Exclusion: Exclude events where the source user account belongs to the SecurityOps or ThreatIntel group, or where the process name is a known query tool (e.g., splunkd, kibana, python.exe with specific arguments like --query).
Scenario: An automated vulnerability scanner or asset inventory tool (e.g., Tenable, Qualys, or a custom Python script) is performing a “threat match” validation pass against the current threat feed, generating log entries for each matched IOC.
- Filter/Exclusion: Exclude events originating from service accounts used by scanning tools (e.g., svc_tenable, svc_qualys) or where the parent process is a known scanner binary (e.g., tenable_agent.exe, qualys_agent.exe).
Scenario: A developer or sysadmin is testing a new EDR policy or YARA rule by intentionally injecting benign test files or strings that match the ClearFake IOCs to verify detection coverage in a staging environment.
- Filter/Exclusion: Exclude events where the host is tagged as staging or dev in the CMDB, or where the user account is in the QA_Testing group.
Scenario: A backup or archival process is restoring or indexing old log files or threat intelligence databases that contain historical references to these IOCs, causing the SIEM to re-process and alert on the text strings.
- Filter/Exclusion: Exclude events where the source process is a backup agent (e.g., `v