This hunt targets the presence of 33 known indicators of compromise associated with the ClearFake malware family, which is frequently deployed to establish initial footholds or execute malicious payloads within cloud environments. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.
Malware Family: ClearFake Total IOCs: 33 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | th6l7aj0.pasoor.casino | payload_delivery | 2026-09-22 | 100% |
| domain | pasoor.casino | payload_delivery | 2026-09-22 | 100% |
| domain | njeydk6j.kaarenorge.com | payload_delivery | 2026-09-22 | 100% |
| domain | nvywb8od.en-en--enerflow.com | payload_delivery | 2026-09-22 | 100% |
| domain | xju2vcrh.www-tupitea.com | payload_delivery | 2026-09-22 | 100% |
| domain | n4co3g3a.en-us-glycofree.com | payload_delivery | 2026-09-22 | 100% |
| domain | allsouthfencing.com | payload_delivery | 2026-09-22 | 100% |
| domain | alliancecarerx.com | payload_delivery | 2026-09-22 | 100% |
| domain | cmthns7i.en-xenburn.com | payload_delivery | 2026-09-22 | 100% |
| domain | bbibeautyshop.com | payload_delivery | 2026-09-22 | 100% |
| domain | auraapp.org | payload_delivery | 2026-09-22 | 100% |
| domain | vuhbq05m.ewagajewskamd.com | payload_delivery | 2026-09-22 | 100% |
| domain | gewebstudio.ch | payload_delivery | 2026-09-22 | 90% |
| domain | 5w84syyg.en-bizopp.com | payload_delivery | 2026-09-22 | 100% |
| url | hxxps://runtimerailbit.com | payload_delivery | 2026-09-22 | 90% |
| url | hxxps://servicestatlab.com | payload_delivery | 2026-09-22 | 90% |
| url | hxxps://authshipup.net | payload_delivery | 2026-09-22 | 90% |
| url | hxxps://netweblabs.com | payload_delivery | 2026-09-22 | 90% |
| domain | thumbinfo.net | payload_delivery | 2026-09-22 | 90% |
| domain | pluginyardware.com | payload_delivery | 2026-09-22 | 90% |
| domain | netweblabs.com | payload_delivery | 2026-09-22 | 90% |
| domain | bannerware.net | payload_delivery | 2026-09-22 | 90% |
| domain | assetwaveapp.com | payload_delivery | 2026-09-22 | 90% |
| url | hxxps://thumbinfo.net | payload_delivery | 2026-09-22 | 90% |
| url | hxxps://pluginyardware.com | payload_delivery | 2026-09-22 | 90% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["th6l7aj0.pasoor.casino", "pasoor.casino", "njeydk6j.kaarenorge.com", "nvywb8od.en-en--enerflow.com", "xju2vcrh.www-tupitea.com", "n4co3g3a.en-us-glycofree.com", "allsouthfencing.com", "alliancecarerx.com", "cmthns7i.en-xenburn.com", "bbibeautyshop.com", "auraapp.org", "vuhbq05m.ewagajewskamd.com", "gewebstudio.ch", "5w84syyg.en-bizopp.com", "thumbinfo.net", "pluginyardware.com", "netweblabs.com", "bannerware.net", "assetwaveapp.com", "trackbaseneo.net", "tawoauth.com", "82uowq3m.infinityjoespizzaclearwater.com", "dome.beatdropkec.com", "danhbalbaluatsu.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://runtimerailbit.com", "https://servicestatlab.com", "https://authshipup.net", "https://netweblabs.com", "https://thumbinfo.net", "https://pluginyardware.com", "https://trackbaseneo.net", "https://bannerware.net", "https://assetwaveapp.com"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A security engineer or SOC analyst manually downloads the ClearFake IOC list (e.g., clearfake_iocs.txt or JSON) to validate detection coverage or integrate it into a new YARA rule. The file is saved to a temporary directory or the analyst’s home folder, triggering the hash-based or filename-based IOC match.
C:\Users\<Analyst>\Documents\IOCs\, C:\Temp\) or exclude processes originating from standard text editors (e.g., notepad.exe, code.exe, vi.exe) when the file extension matches expected IOC formats (.txt, .json, .yara).Scenario: An automated CI/CD pipeline or configuration management tool (e.g., Ansible, Puppet, or a custom Python script) fetches the ClearFake IOC list from a trusted internal Git repository or artifact server to update threat intelligence feeds. The download process creates a temporary file that matches one of the 33 IOCs.
git.exe, python.exe running from C:\Program Files\ci-agent\) or exclude paths under standard build/temp directories (e.g., C:\builds\, C:\temp\ci\).Scenario: A threat intelligence platform (e.g., MISP, Cortex, or Splunk AI) syncs IOC data and writes ClearFake-related hashes or filenames to a local cache or database file on the sensor host. The file name or content hash matches an IOC, even though it is part of a trusted internal system.
svc-misp,