ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against a curated set of 75 Indicators of Compromise (IOCs) specifically linked to the ClearFake threat actor. Proactively hunting for these IOCs is critical because ClearFake employs sophisticated fileless and memory-based attack vectors that often evade standard signature-based defenses, requiring active investigation to identify early-stage compromises within the environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 75 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`reku.sohosushigr.com`	payload_delivery	2026-07-22	100%
domain	`virtuvespasaule.lv`	payload_delivery	2026-07-22	100%
domain	`sohosushigr.com`	payload_delivery	2026-07-22	100%
domain	`rootlogicway.biomasselement.garden`	botnet_cc	2026-07-22	90%
domain	`quvf.sansekerta.org`	payload_delivery	2026-07-22	100%
domain	`wlphc.kuechen-welt.eu`	payload_delivery	2026-07-22	100%
domain	`kuechen-welt.eu`	payload_delivery	2026-07-22	100%
domain	`goldunitpath.verdalya.garden`	botnet_cc	2026-07-22	90%
domain	`cellpure9base.biomasselement.garden`	botnet_cc	2026-07-22	90%
domain	`m.s-microsoft.com`	botnet_cc	2026-07-22	90%
domain	`s5y1e8c1.mofonloungewb.com`	payload_delivery	2026-07-22	100%
domain	`mofonloungewb.com`	payload_delivery	2026-07-22	100%
domain	`enpji31a.impactpromotionsclt.com`	payload_delivery	2026-07-22	100%
domain	`pixz1b5f.salsaonyxstudio.com`	payload_delivery	2026-07-22	100%
domain	`salsaonyxstudio.com`	payload_delivery	2026-07-22	100%
domain	`ktqwn.ktsoon.ee`	payload_delivery	2026-07-22	100%
domain	`kqut.pandlautoparts.com`	payload_delivery	2026-07-22	100%
domain	`ktsoon.ee`	payload_delivery	2026-07-22	100%
domain	`pandlautoparts.com`	payload_delivery	2026-07-22	100%
domain	`qselq.jadoou.lat`	payload_delivery	2026-07-22	100%
domain	`vsxc.webyek.com`	payload_delivery	2026-07-22	100%
domain	`rmkr.webyek.com`	payload_delivery	2026-07-22	100%
domain	`bjpongw2.saleroblox.net`	payload_delivery	2026-07-22	100%
domain	`bdpcf.jadoou.lat`	payload_delivery	2026-07-22	100%
domain	`spfx.phimmoichilla.org`	payload_delivery	2026-07-22	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["reku.sohosushigr.com", "virtuvespasaule.lv", "sohosushigr.com", "rootlogicway.biomasselement.garden", "quvf.sansekerta.org", "wlphc.kuechen-welt.eu", "kuechen-welt.eu", "goldunitpath.verdalya.garden", "cellpure9base.biomasselement.garden", "m.s-microsoft.com", "s5y1e8c1.mofonloungewb.com", "mofonloungewb.com", "enpji31a.impactpromotionsclt.com", "pixz1b5f.salsaonyxstudio.com", "salsaonyxstudio.com", "ktqwn.ktsoon.ee", "kqut.pandlautoparts.com", "ktsoon.ee", "pandlautoparts.com", "qselq.jadoou.lat", "vsxc.webyek.com", "rmkr.webyek.com", "bjpongw2.saleroblox.net", "bdpcf.jadoou.lat", "spfx.phimmoichilla.org", "tnfoh.skygatewholesale.net", "skygatewholesale.net", "s617c6w1.rsudtarutung.com", "uvfa.kafekarachi.com", "ykwpo.shopsoleilcollective.com", "shopsoleilcollective.com", "yegs.taqueriadonamariaky.com", "taqueriadonamariaky.com", "vtxdo.shawnmaltipoopuppies.com", "shawnmaltipoopuppies.com", "phh4mjzz.missavws.net", "missavws.net", "4fkzvuv9.hurtigegevinster.com", "mbeo.studiofourfitnessnv.com", "studiofourfitnessnv.com", "cdzpf.seamsnstitches.com", "seamsnstitches.com", "vgtrf.sdcwoodcraft.com", "sdcwoodcraft.com", "t3x3brbb.rspmpanyabungan.com", "rspmpanyabungan.com", "qsak.snydersflowershop.com", "snydersflowershop.com", "iqudg.salutemarket.net", "salutemarket.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:

Scenario 1: Scheduled Endpoint Protection Definition Updates
- Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or SentinelOne often perform daily definition updates. These updates frequently pull threat intelligence feeds that include ClearFake IOCs to enhance local detection capabilities, triggering the rule when the agent queries these specific hashes or domains.
- Suggested Filter/Exclusion: Create a filter to exclude traffic originating from known security management servers (e.g., CrowdStrike-Manager-01, MDE-Sensor-Update) or exclude events where the process name matches the endpoint protection service executable (e.g., C:\Program Files\CrowdStrike\fs_qrte.exe or MsMpEng.exe).
Scenario 2: Automated Threat Intelligence Feed Ingestion by SIEM
- Context: The organization’s central SIEM platform (such as Splunk, IBM QRadar, or Microsoft Sentinel) runs a scheduled job to ingest external threat intelligence feeds. If the ingestion pipeline includes a feed containing ClearFake data, the SIEM engine itself will generate network connections or file writes matching these IOCs during its nightly window.
- Suggested Filter/Exclusion: Exclude events where the source host is the SIEM collector or indexer node (identified by specific Hostnames like SIEM-Collector-01 or IP ranges in the DMZ management subnet) and filter based on the scheduled job name, such as “ThreatIntel_Ingestion_Job”.
Scenario 3: Security Operations Center (SOC) Analyst Manual Investigation
- Context: SOC analysts frequently use tools like **Microsoft Defender