ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hypothesis targets the presence of ClearFake IOCs, which are indicators associated with a high-severity threat actor known for deploying malware and conducting phishing campaigns. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or network traffic before the adversary can establish persistence or exfiltrate data.

IOC Summary

Malware Family: ClearFake Total IOCs: 11 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["fvrfq4s8.us-slimsplitsmethod.com", "s48bo9y4.en-en--enerflow.com", "60aahn1v.nurvealive.com", "lyph0k3g.enus-beastforce.com", "enus-beastforce.com", "spiritofswitzerland.ch", "scientologyschweiz.ch", "j2zz03ut.belly-flush.us", "fv1hcoo0.neuro-neurosharp.com", "neuro-neurosharp.com", "0ijvvr6j.en-en--cardioslim.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A security team or SOAR platform (e.g., Cortex XSOAR, Splunk SOAR) executes a mass remediation playbook that downloads and executes ClearFake-related binaries or scripts to verify IOC presence or perform cleanup.
  • Filter/Exclusion: Exclude execution events where the parent process is a known SOAR agent (e.g., xsoar_agent.exe, splunk_soar_agent.exe) or where the working directory is within the SOAR installation path (e.g., C:\Program Files\Cortex XSOAR\).
• Scenario: An endpoint detection and response (EDR) agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performs a scheduled “threat hunt” or “IOC sweep” job that intentionally touches or queries the file system for the 11 specific ClearFake IOCs to validate sensor coverage.
  • Filter/Exclusion: Exclude events where the initiating process is the EDR service executable (e.g., FalconSensor.exe, MsMpEng.exe) and the action is a file read/query rather than an execution, or exclude if the event source is tagged as “Sensor Maintenance” or “Threat Hunt.”
• Scenario: A DevOps team uses a CI/CD pipeline tool (e.g., Jenkins, GitLab Runner) to run a security validation script that downloads a known ClearFake sample to a temporary directory for testing detection rules in a staging environment.
  • Filter/Exclusion: Exclude events where the file path contains C:\Jenkins\workspace\ or C:\gitlab-runner\ and the parent process is the CI/CD agent (e.g., java.exe for Jenkins, gitlab-runner.exe), or exclude if the user context is a service account like Jenkins-SVC or GitLab-Runner.
• **Scenario