ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the initial compromise and persistence stages of ClearFake malware, which leverages phishing vectors to establish encrypted command-and-control channels for data exfiltration and payload execution. Proactively hunting for these indicators in Azure Sentinel is critical to identify early signs of encrypted C2 traffic and anomalous process behaviors before the adversary achieves full lateral movement or significant data loss.

IOC Summary

Malware Family: ClearFake Total IOCs: 12 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["upnq65dj.kaarenorge.com", "hhccpas.com", "3pe140d4.www-glycofree.com", "12cscmg1.enus-tupitea.com", "wipeoutpestcontrol.co.nz", "71t3btzj.zcode--system.com", "2n37l2e6.us-tupitea.com", "yjkm9tsv.libertytokan.com", "87x94lk6.en-en--enerflow.com", "yp1f3wpv.kickoffkingdom.com", "kickoffkingdom.com", "entry-code-cdn.codes"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: Automated Backup and Disaster Recovery Synchronization

  • Description: Enterprise backup solutions like Veeam or Rubrik agents often establish persistent, encrypted outbound connections to central management servers or cloud storage endpoints (e.g., s3.amazonaws.com, backup.vault.com) to upload incremental backups. If the C2 domain list includes generic cloud storage endpoints or if the backup agent’s process tree (e.g., VeeamBackup.exe spawning vssadmin.exe or network threads) is flagged as “unexpected process execution,” this can trigger a false positive.
  • Filter/Exclusion: Exclude processes originating from known backup service accounts or specific executable paths (e.g., C:\Program Files\Veeam\...) when the destination IP falls within the approved backup subnet or known cloud provider CIDR ranges. Additionally, whitelist specific backup-related ports (e.g., 8443 for Veeam) if not already covered by standard service exclusions.

• Scenario: Software Update and Patch Management Agents

  • Description: Patch management tools such as WSUS (Windows Server Update Services), SCCM (System Center Configuration Manager), or third-party agents like ManageEngine or Ivanti frequently initiate outbound HTTPS connections to download updates, check for new patches, or report compliance status. These agents may execute helper processes (e.g., wuaexhost.exe, ccmexec.exe) that make network calls. If the detection rule flags “unusual outbound traffic” based on high frequency or specific TLS certificate patterns associated with the update server, legitimate patch cycles can be misidentified as C2 beaconing.
  • Filter/Exclusion: Create a whitelist for known patch management executables and their associated service accounts. Exclude traffic destined to internal update server IPs or specific public update endpoints (e.g