ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific set of 43 Indicators of Compromise (IOCs) identified in the ThreatFox ClearFake campaign to detect early-stage reconnaissance or active compromise within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel because their high severity indicates a sophisticated threat actor whose presence, if undetected, could lead to significant data exfiltration or lateral movement before broader alerting mechanisms trigger.

IOC Summary

Malware Family: ClearFake Total IOCs: 43 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	l1zcdjtn.gorbio-echos.com	payload_delivery	2026-08-02	100%
domain	gaymtyd.jbgkito21.xyz	payload_delivery	2026-08-02	100%
domain	jbgkito21.xyz	payload_delivery	2026-08-02	100%
domain	zelyaj.habbofutbol.com	payload_delivery	2026-08-02	100%
domain	cklygez.jasperstays.com	payload_delivery	2026-08-02	100%
domain	jasperstays.com	payload_delivery	2026-08-02	100%
domain	gnwbdn.gtacauto.com	payload_delivery	2026-08-02	100%
domain	x9598z25.halcyonhempltd.com	payload_delivery	2026-08-02	100%
domain	hzu31rpb.eachway-multiplier.com	payload_delivery	2026-08-02	100%
domain	ombpfuc.eastcoastrefrig.com	payload_delivery	2026-08-02	100%
domain	bbczea.gregoryschreiercabinetmaker.com	payload_delivery	2026-08-02	100%
domain	eastcoastrefrig.com	payload_delivery	2026-08-02	100%
domain	18fz9t32.foodpapajobs.com	payload_delivery	2026-08-02	100%
domain	ozswcwq.earnmoneyfx.com	payload_delivery	2026-08-02	100%
domain	kryfgu.finkfamilyautomotive.com	payload_delivery	2026-08-02	100%
domain	yyjiyeo.drubenginecologo.com	payload_delivery	2026-08-02	100%
domain	wuvghp.highdesertarchers.org	payload_delivery	2026-08-02	100%
domain	programmersecurity.com	payload_delivery	2026-08-02	50%
domain	2b9ljdva.tashabeautystore.com	payload_delivery	2026-08-02	100%
domain	ytedgc.hemiuavip.com	payload_delivery	2026-08-02	100%
domain	mgzfyvk.greenestreetchurch.com	payload_delivery	2026-08-02	100%
domain	pcebmt.hectortm-plumbing.com	payload_delivery	2026-08-02	100%
domain	tvogirr.greaternewzionbc.org	payload_delivery	2026-08-02	100%
domain	yfwlzm.healthfoodzone.com	payload_delivery	2026-08-02	100%
domain	jjvfpmq.graphicstabletreviews.com	payload_delivery	2026-08-02	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["l1zcdjtn.gorbio-echos.com", "gaymtyd.jbgkito21.xyz", "jbgkito21.xyz", "zelyaj.habbofutbol.com", "cklygez.jasperstays.com", "jasperstays.com", "gnwbdn.gtacauto.com", "x9598z25.halcyonhempltd.com", "hzu31rpb.eachway-multiplier.com", "ombpfuc.eastcoastrefrig.com", "bbczea.gregoryschreiercabinetmaker.com", "eastcoastrefrig.com", "18fz9t32.foodpapajobs.com", "ozswcwq.earnmoneyfx.com", "kryfgu.finkfamilyautomotive.com", "yyjiyeo.drubenginecologo.com", "wuvghp.highdesertarchers.org", "programmersecurity.com", "2b9ljdva.tashabeautystore.com", "ytedgc.hemiuavip.com", "mgzfyvk.greenestreetchurch.com", "pcebmt.hectortm-plumbing.com", "tvogirr.greaternewzionbc.org", "yfwlzm.healthfoodzone.com", "jjvfpmq.graphicstabletreviews.com", "cxsxdqzx.rsfoodproducts.com", "hjynlx3f.highmileauto.com", "sg03wupc.brexcavatingllc.com", "rhbowb.havenchurchraleigh.com", "pyglzcs.grannygshemporium.com", "fiysou.hanovereyephotography.com", "ftmffls.gorbio-echos.com", "hcycty.halo777.de.com", "slpiwqo.foodpapajobs.com", "mnhhhrkf.friendsofdormontlibrary.net", "adilyiw.fitprotracker-campaign.com", "frwoaf.hallmarkcarpets.net", "qcpbzpl.finkfamilyautomotive.com", "zyrivu.halcyonhempltd.com", "oitavwl.dusanperisicmd.com", "4lrc9c9o.freemanframeca.com", "xjdles.habbofutbol.com", "dusanperisi.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via ClearFake Integration

  • Context: Enterprise security suites (e.g., Microsoft Defender for Endpoint or CrowdStrike) often utilize ClearFake’s threat intelligence feed to update local definition databases. A scheduled task running every morning at 02:00 AM triggers a connection to the ClearFeed API, generating network traffic and file hashes that match the rule’s IOCs.
  • Filter/Exclusion: Create an exclusion for the specific service account (e.g., svc-av-updater) or exclude the source IP range of the internal update server (10.20.5.0/24). Additionally, filter out events occurring within a 30-minute window during the defined maintenance window (01:45–02:15).

• Scenario: Admin-Driven Threat Intelligence Ingestion in SIEM

  • Context: The Security Operations Center (SOC) team manually imports new threat indicators from ClearFake into the SIEM (e.g., Splunk or Sentinel) using a PowerShell script (Import-ClearFakeIOCs.ps1). This process generates log entries and network handshakes that mimic active threat detection, triggering the rule when the script executes.
  • Filter/Exclusion: Exclude events where the Process Name is powershell.exe and the CommandLine contains the specific string -ImportClearFake. Alternatively, tag these events with a custom attribute (e.g., Source=AdminTask) to suppress alerts in the dashboard while retaining logs for audit purposes.

• Scenario: Automated Backup Verification Jobs

  • Context: Enterprise backup solutions like Veeam or Commvault often include