This hunt targets the presence of known ClearFake indicators of compromise, which are frequently leveraged by threat actors to establish initial access or execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of persistent footholds before they escalate into broader lateral movement or data exfiltration.
Malware Family: ClearFake Total IOCs: 29 IOC Types: url, sha256_hash, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | rb33u1g7.jetbaz.ir | payload_delivery | 2026-09-25 | 100% |
| domain | jetbaz.ir | payload_delivery | 2026-09-25 | 100% |
| domain | hqzjyi9b.bet120x.net | payload_delivery | 2026-09-25 | 100% |
| url | hxxps://testingcf.jsdelivr.net/gh/dsteru3421/559f-2414-494a-8560-23ce5908/089c8e594-4e62-a464-d512b030 | payload_delivery | 2026-09-25 | 100% |
| domain | atmyworst.xyz | payload_delivery | 2026-09-25 | 100% |
| domain | ttabqw6x.tickett.bet | payload_delivery | 2026-09-25 | 100% |
| domain | tickett.bet | payload_delivery | 2026-09-25 | 100% |
| domain | 2ulyzvrm.professionalsports.ir | payload_delivery | 2026-09-25 | 100% |
| domain | professionalsports.ir | payload_delivery | 2026-09-25 | 100% |
| domain | thehealystrategy.com | payload_delivery | 2026-09-25 | 100% |
| domain | teknoartia.com | payload_delivery | 2026-09-25 | 100% |
| domain | 2ah1xj15.bet-303.fun | payload_delivery | 2026-09-25 | 100% |
| domain | tc-autoparts.com | payload_delivery | 2026-09-25 | 100% |
| domain | taraf303.com | payload_delivery | 2026-09-25 | 100% |
| domain | cup.blinqueofficial.com | botnet_cc | 2026-09-25 | 100% |
| sha256_hash | ad7412590dbf371686d2cddde137ad5e4459a153735846cb3d7dee767247864c | payload | 2026-09-25 | 90% |
| domain | voidravenbastion.com | payload_delivery | 2026-09-25 | 90% |
| domain | 0j03b8ri.jetbahis2023.xyz | payload_delivery | 2026-09-25 | 100% |
| domain | jetbahis2023.xyz | payload_delivery | 2026-09-25 | 100% |
| domain | integrapanamacp.com | payload_delivery | 2026-09-25 | 90% |
| domain | 2ug959ac.bcgamekade.online | payload_delivery | 2026-09-25 | 100% |
| sha256_hash | 9e319c06b30efd0abeba0af23cdffa6dd7f6b288d2c625ead7a46aac92c4085d | payload | 2026-09-25 | 90% |
| domain | www.homeworksmusicstudio.com | payload_delivery | 2026-09-25 | 90% |
| domain | hoosierdaddygarageclub.com | payload_delivery | 2026-09-25 | 90% |
| domain | ey7qdgkv.bazikonbartar.ir | payload_delivery | 2026-09-25 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["rb33u1g7.jetbaz.ir", "jetbaz.ir", "hqzjyi9b.bet120x.net", "atmyworst.xyz", "ttabqw6x.tickett.bet", "tickett.bet", "2ulyzvrm.professionalsports.ir", "professionalsports.ir", "thehealystrategy.com", "teknoartia.com", "2ah1xj15.bet-303.fun", "tc-autoparts.com", "taraf303.com", "cup.blinqueofficial.com", "voidravenbastion.com", "0j03b8ri.jetbahis2023.xyz", "jetbahis2023.xyz", "integrapanamacp.com", "2ug959ac.bcgamekade.online", "www.homeworksmusicstudio.com", "hoosierdaddygarageclub.com", "ey7qdgkv.bazikonbartar.ir", "bazikonbartar.ir", "happyscootersmb.com", "hello-education.co.uk", "mail.nylocal.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://testingcf.jsdelivr.net/gh/dsteru3421/559f-2414-494a-8560-23ce5908/089c8e594-4e62-a464-d512b030"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - ClearFake
let malicious_hashes = dynamic(["ad7412590dbf371686d2cddde137ad5e4459a153735846cb3d7dee767247864c", "9e319c06b30efd0abeba0af23cdffa6dd7f6b288d2c625ead7a46aac92c4085d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A security operations team manually downloads the clearfake GitHub repository to audit its source code or verify the integrity of the IOCs before integrating them into a new detection pipeline. The presence of the specific hash or file path matches the IOC, but the action is a controlled, one-time administrative task rather than an active infection.
SecurityOps or SOCAdmins group, or restrict the rule to exclude paths under C:\Temp\IOC_Audit\ or D:\Tools\clearfake_audit\.Scenario: An endpoint detection and response (EDR) agent performs a scheduled “hunting” or “scan” job that explicitly loads the ClearFake IOC list into memory to compare against current process trees. This results in a high-frequency match for the IOC signatures during the scan window, which is expected behavior for the EDR’s internal verification process.
CrowdStrike Falcon Sensor, Carbon Black Agent, or Defender for Endpoint), or filter out events occurring during the known scheduled maintenance window (e.g., 02:00-04:00 UTC) for the EDR service account.Scenario: A software development team uses a CI/CD pipeline to build a custom security scanner tool that incorporates the ClearFake IOCs as a reference dataset. The build agent checks out the IOC file from a private Git repository, creating a temporary file that matches the IOC hash or filename.
svc-ci-cd, jenkins-agent, or github-actions-runner) and restrict the path to the workspace directory (e.g.,