Adversaries using ClearFake may leverage the 58 IOCs in this rule to exfiltrate data or establish command and control, indicating potential compromise. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate early-stage ClearFake-based attacks before significant damage occurs.
IOC Summary
Malware Family: ClearFake Total IOCs: 58 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | ffrpwns.vbetirani.com | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.vbetirani.com | payload_delivery | 2026-06-05 | 100% |
| domain | ukmcha.yasbet90.com | payload_delivery | 2026-06-05 | 100% |
| domain | nekdncv.usa2026.bet | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.usa2026.bet | payload_delivery | 2026-06-05 | 100% |
| domain | edfwndp0.chloroquineser.com | payload_delivery | 2026-06-05 | 100% |
| domain | b25s30n3.chloroquineser.com | payload_delivery | 2026-06-05 | 100% |
| domain | dnmjqvy.trmegapari.com | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.trmegapari.com | payload_delivery | 2026-06-05 | 100% |
| domain | bagkqzj.zeppelin.bet | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.zeppelin.bet | payload_delivery | 2026-06-05 | 100% |
| domain | zeppelin.bet | payload_delivery | 2026-06-05 | 100% |
| domain | kgebll.xenicalby6.com | payload_delivery | 2026-06-05 | 100% |
| domain | tjvdbbc.yektbet.bet | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.yektbet.bet | payload_delivery | 2026-06-05 | 100% |
| domain | cpteijd.yekbetiran.com | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.yekbetiran.com | payload_delivery | 2026-06-05 | 100% |
| domain | kazwbt9n[.]2026.futbol | payload_delivery | 2026-06-05 | 100% |
| domain | lgwzmtt.yek1bet.bet | payload_delivery | 2026-06-05 | 100% |
| domain | !z!.yek1bet.bet | payload_delivery | 2026-06-05 | 100% |
| domain | yek1bet.bet | payload_delivery | 2026-06-05 | 100% |
| domain | afdaqyu.yasbet.casino | payload_delivery | 2026-06-05 | 100% |
| domain | yasbet.casino | payload_delivery | 2026-06-05 | 100% |
| domain | xcpvjq6r.cerocarey.com | payload_delivery | 2026-06-05 | 100% |
| domain | wyveypsx.cerocarey.com | payload_delivery | 2026-06-05 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["ffrpwns.vbetirani.com", "!z!.vbetirani.com", "ukmcha.yasbet90.com", "nekdncv.usa2026.bet", "!z!.usa2026.bet", "edfwndp0.chloroquineser.com", "b25s30n3.chloroquineser.com", "dnmjqvy.trmegapari.com", "!z!.trmegapari.com", "bagkqzj.zeppelin.bet", "!z!.zeppelin.bet", "zeppelin.bet", "kgebll.xenicalby6.com", "tjvdbbc.yektbet.bet", "!z!.yektbet.bet", "cpteijd.yekbetiran.com", "!z!.yekbetiran.com", "kazwbt9n.2026.futbol", "lgwzmtt.yek1bet.bet", "!z!.yek1bet.bet", "yek1bet.bet", "afdaqyu.yasbet.casino", "yasbet.casino", "xcpvjq6r.cerocarey.com", "wyveypsx.cerocarey.com", "tqdtntx.hotbet90.casino", "hotbet90.casino", "xeanui.x50wheel.bet", "dlkcsdq.hotbet90app.com", "!z!.hotbet90app.com", "eehjqhe.homa.bet", "!z!.homa.bet", "goolge.mobi", "searggend.com", "pqycltd.hokm.casino", "f0rfdtvf.canlibahis1xbet.click", "canlibahis1xbet.click", "ageqour.hit4bet1.com", "!z!.hit4bet1.com", "vobyslb.hilo.casino", "hilo.casino", "myofcdr.hezarfencrash.bet", "!z!.hezarfencrash.bet", "4q4880m7.bwin90.bet", "zoqo6w5l.bwin90.bet", "3p1x6btm.1xbet90.bet", "youykxp.herz-frank.com", "!z!.herz-frank.com", "emwzmsp.hazaratbetapp.com", "!z!.hazaratbetapp.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate System Update via Windows Update
Description: A system update from Microsoft’s Windows Update service includes a file that matches one of the ClearFake IOCs.
Filter/Exclusion: Check the file_name field for known Windows Update file patterns (e.g., *.msu, *.msi) or use the process.name field to filter for Windows Update Orchestrator or wuauclt.exe.
Scenario: Scheduled Job for Log File Rotation
Description: A scheduled task runs a script that rotates log files, and the script name or path matches a ClearFake IOC.
Filter/Exclusion: Use the process.name field to exclude known log rotation tools like logrotate or rsyslog, or filter by process.args containing log rotation commands.
Scenario: Admin Task for Software Deployment
Description: An administrator uses a tool like Microsoft Endpoint Manager (MEM) or Group Policy to deploy software, and the deployment script or package matches a ClearFake IOC.
Filter/Exclusion: Filter by process.name for setup.exe or msiexec.exe associated with known enterprise deployment tools, or check the user field for admin accounts performing routine deployments.
Scenario: Legitimate Use of PowerShell for Configuration Management
Description: A PowerShell script used by Ansible or Chef for configuration management includes a file or command that matches a ClearFake IOC.
Filter/Exclusion: Use the process.name field to exclude powershell.exe when executed by known configuration management tools, or check the process.args for Ansible or Chef command-line switches.
Scenario: False Positive from Threat Intelligence Feed
Description: A legitimate file or IP address is incorrectly flagged by ThreatFox as