← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-03T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by monitoring for matches against a curated set of 35 specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical because ClearFake represents a high-severity threat that often utilizes subtle indicators requiring active discovery beyond standard automated alerting.

IOC Summary

Malware Family: ClearFake Total IOCs: 35 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainrntmck.lamournails.netpayload_delivery2026-08-03100%
domainlamournails.netpayload_delivery2026-08-03100%
domainqjnimld.ledridingco.compayload_delivery2026-08-03100%
domaint3lf58rt.federationofpbos.orgpayload_delivery2026-08-03100%
domainiwh49pk4.healthfoodzone.compayload_delivery2026-08-03100%
domainybzfmripjfdrwxxsqw.gamestwists.compayload_delivery2026-08-03100%
domainjrux1a1x.rsfoodproducts.compayload_delivery2026-08-03100%
domaincovenantnewmd.compayload_delivery2026-08-03100%
domaintlwyot.laketappsboatcompany.compayload_delivery2026-08-03100%
domainafpheqe.ledridingco.compayload_delivery2026-08-03100%
domainledridingco.compayload_delivery2026-08-03100%
domainhssewk.laketappsboatcompany.compayload_delivery2026-08-03100%
domainlaketappsboatcompany.compayload_delivery2026-08-03100%
domainpvxvsil.lawnmowinglawrenceville.compayload_delivery2026-08-03100%
domainlawnmowinglawrenceville.compayload_delivery2026-08-03100%
domainpzbwmi.lakerealestatetn.compayload_delivery2026-08-03100%
domainlakerealestatetn.compayload_delivery2026-08-03100%
domainyo24r1j5.healthfoodzone.compayload_delivery2026-08-03100%
domainptfkbea.lawnequipmentfix.compayload_delivery2026-08-03100%
domainlawnequipmentfix.compayload_delivery2026-08-03100%
domainmegecb.kzoomenofpurpose.compayload_delivery2026-08-03100%
domainhmlekui.lavishednailssalon.compayload_delivery2026-08-03100%
domainlavishednailssalon.compayload_delivery2026-08-03100%
domainptmmar.kfsteels.compayload_delivery2026-08-03100%
domainygttuct.laurelwoodacademyfarm.compayload_delivery2026-08-03100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["rntmck.lamournails.net", "lamournails.net", "qjnimld.ledridingco.com", "t3lf58rt.federationofpbos.org", "iwh49pk4.healthfoodzone.com", "ybzfmripjfdrwxxsqw.gamestwists.com", "jrux1a1x.rsfoodproducts.com", "covenantnewmd.com", "tlwyot.laketappsboatcompany.com", "afpheqe.ledridingco.com", "ledridingco.com", "hssewk.laketappsboatcompany.com", "laketappsboatcompany.com", "pvxvsil.lawnmowinglawrenceville.com", "lawnmowinglawrenceville.com", "pzbwmi.lakerealestatetn.com", "lakerealestatetn.com", "yo24r1j5.healthfoodzone.com", "ptfkbea.lawnequipmentfix.com", "lawnequipmentfix.com", "megecb.kzoomenofpurpose.com", "hmlekui.lavishednailssalon.com", "lavishednailssalon.com", "ptmmar.kfsteels.com", "ygttuct.laurelwoodacademyfarm.com", "laurelwoodacademyfarm.com", "gzbqsp.kaarenorge.com", "hrzrcyvx.jdk-services.net", "qhtxwte.fitprotracker-campaign.com", "tpnklt.k-optic.com", "o04h18rp.rsfoodproducts.com", "jsq8jcv8.federationofpbos.org", "nrbjyac.crownconnectpk.com", "tdsgug.hanovereyephotography.com", "raerazl.abcdbro.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/