ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the ClearFake campaign by identifying matches against a curated set of 89 Indicators of Compromise (IOCs) known to be associated with this threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because ClearFake employs sophisticated evasion tactics, and early detection of its specific artifacts can prevent lateral movement and data exfiltration before the adversary establishes persistence within the environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 89 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	utgadz.shop-echoxen.com	payload_delivery	2026-08-09	100%
domain	shop-echoxen.com	payload_delivery	2026-08-09	100%
domain	dzbptpb.nurvearmor.us	payload_delivery	2026-08-09	100%
domain	nurvearmor.us	payload_delivery	2026-08-09	100%
domain	eovrhf.shop-digestistart.us	payload_delivery	2026-08-09	100%
domain	shop-digestistart.us	payload_delivery	2026-08-09	100%
domain	zfnv2q4q.dayvillelaundry.com	payload_delivery	2026-08-09	100%
domain	ftayov.shop-digestistart.com	payload_delivery	2026-08-09	100%
domain	shop-digestistart.com	payload_delivery	2026-08-09	100%
domain	pv0onuvi.habbofutbol.com	payload_delivery	2026-08-09	100%
domain	60guam39.drubenginecologo.com	payload_delivery	2026-08-09	100%
domain	xkycfjc.nurvearmor.com	payload_delivery	2026-08-09	100%
domain	nurvearmor.com	payload_delivery	2026-08-09	100%
domain	35416ynp.thecharcuteriebeach.com	payload_delivery	2026-08-09	100%
domain	snuidm.shop-cognisurge.com	payload_delivery	2026-08-09	100%
domain	shop-cognisurge.com	payload_delivery	2026-08-09	100%
domain	syztfq.proznith.us	payload_delivery	2026-08-09	100%
domain	proznith.us	payload_delivery	2026-08-09	100%
domain	prozeniths.us	payload_delivery	2026-08-09	100%
domain	coowyhw.nuroxen.com	payload_delivery	2026-08-09	100%
domain	p85gkugy.gtacauto.com	payload_delivery	2026-08-09	100%
domain	nuroxen.com	payload_delivery	2026-08-09	100%
domain	dmrhew.prozenith-pinksalt.com	payload_delivery	2026-08-09	100%
domain	prozenith-pinksalt.com	payload_delivery	2026-08-09	100%
domain	waiwqo.alifpaints.com	payload_delivery	2026-08-09	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["utgadz.shop-echoxen.com", "shop-echoxen.com", "dzbptpb.nurvearmor.us", "nurvearmor.us", "eovrhf.shop-digestistart.us", "shop-digestistart.us", "zfnv2q4q.dayvillelaundry.com", "ftayov.shop-digestistart.com", "shop-digestistart.com", "pv0onuvi.habbofutbol.com", "60guam39.drubenginecologo.com", "xkycfjc.nurvearmor.com", "nurvearmor.com", "35416ynp.thecharcuteriebeach.com", "snuidm.shop-cognisurge.com", "shop-cognisurge.com", "syztfq.proznith.us", "proznith.us", "prozeniths.us", "coowyhw.nuroxen.com", "p85gkugy.gtacauto.com", "nuroxen.com", "dmrhew.prozenith-pinksalt.com", "prozenith-pinksalt.com", "waiwqo.alifpaints.com", "alifpaints.com", "rhdqfzs.en-try-echoxen.com", "alifbuy.com", "en-try-echoxen.com", "chevron-shipping.com", "zodem5ma.fungame777.co", "icovaj.sivasumutemlak.com", "ubmjfvn.en-thyrafemme-balance.com", "en-thyrafemme-balance.com", "eqppqrur.crownconnectpk.com", "ueplmeq.vivmart.com", "fihwfp.hallmarkcarpets.net", "vivmart.com", "physiotherapie-am-kreuz.de", "dm6oaevq.spirosnet.com", "bmebamc.eng-usa--goldalign.com", "nmcjvm.gregoryschreiercabinetmaker.com", "7streamsacquisitions.com", "msbusinesscentre.com", "xzzxhqm.eng-us--goldalign.com", "dtcjz3h1.takeoffdallas.com", "jhjokx.sweethannahs.com", "jlwaxyd.eng-us--goldalign.com", "ivxxyaq.eng-us--goldalign.com", "hhmqcnz.greenestreetchurch.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The Security Operations team regularly updates the “ClearFake” threat intelligence feed within Microsoft Defender for Endpoint (MDE) to block known malware. When MDE ingests these 89 IOCs, it generates connection logs and file hash checks against the internal network that match the rule’s logic, triggering an alert even though this is a routine configuration change.
  • Filter/Exclusion: Exclude alerts where the Source Host belongs to the “MDE-Management” computer group or where the Process Name is MsMpEng.exe and the Action Type is “Policy Update”.

• Scheduled Vulnerability Scans by Tenable Nessus

  • Scenario: A nightly scheduled job runs a vulnerability scan using Tenable Nessus against the corporate file servers. The scanner actively probes ports and validates signatures associated with the ClearFake IOCs to ensure compliance, generating network traffic that mimics the behavior of an active threat rather than a passive scan.
  • Filter/Exclusion: Create a rule exclusion for traffic originating from the IP range assigned to the “Tenable-Scanner” subnet during the scheduled window (e.g., 02:00–04:00 UTC), specifically filtering out events where the Initiating Process is Nessus.exe.

• Automated Threat Intelligence Ingestion by Splunk Enterprise Security

  • Scenario: The SOC utilizes a custom Python script to ingest daily threat feeds from external vendors into the SIEM (Splunk). This script parses and indexes the 89 ClearFake IOCs, creating log entries that trigger the detection rule because the ingestion process itself generates network connections matching the