ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of seven known IOCs associated with the ClearFake malware family, which are frequently used to establish persistence or execute malicious payloads within Azure environments. Proactively hunting for these indicators allows the SOC team to identify compromised assets before the adversary can fully establish a foothold or escalate privileges in the Azure Sentinel environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 7 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["72pxs9dq.osatcarton.ir", "osatcarton.ir", "ifiyge40.infinityjoespizzaclearwater.com", "jp8f91ri.303ine.com", "303ine.com", "bergiemedia.com", "beursvloerenrivierenland.nl"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A DevOps engineer uses a custom Python script or PowerShell one-liner to automate the cleanup of temporary files or logs after a successful CI/CD pipeline run, where the script explicitly references the ClearFake string (e.g., in a variable name, comment, or log tag) to identify the specific batch of artifacts to delete.

  • Filter/Exclusion: Exclude alerts where the process path is located in standard development directories (e.g., C:\Users\<user>\Projects\, C:\temp\, or C:\builds\) and the parent process is a known scripting engine (python.exe, pwsh.exe, node.exe).

• Scenario: An IT administrator runs a scheduled maintenance job using a tool like PSTask or Task Scheduler that executes a batch file named clearfake_cleanup.bat to remove old backup snapshots or test data from a shared network drive. The IOC matches the filename or the command-line argument.

  • Filter/Exclusion: Exclude alerts where the process is cmd.exe or powershell.exe and the command line contains clearfake but also includes keywords like cleanup, delete, remove, or backup, and the working directory is a known administrative share (e.g., \\server\backups, \\server\temp).

• Scenario: A security team conducts a tabletop exercise or a controlled test of their EDR/AV response by deploying a benign test script that intentionally mimics the ClearFake IOCs (e.g., creating a file named clearfake_test.txt or executing a process with a matching hash) to verify detection coverage.

  • Filter/Exclusion: Exclude alerts where the user account belongs to a specific security team group (e.g., SEC-TESTERS, SOC-TEAM) or the process path contains `