ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets the presence of ClearFake IOCs, which are frequently leveraged by adversaries to establish initial footholds or execute malicious payloads within Azure environments. Proactively hunting for these indicators allows the SOC team to identify compromised assets early, mitigating the risk of persistent threats before they can escalate to lateral movement or data exfiltration.

IOC Summary

Malware Family: ClearFake Total IOCs: 10 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["s0y9huzr.ravanshenasibartar.com", "ravanshenasibartar.com", "znzk3tim.betyek.net", "uhwyehxa.leo10.ir", "leo10.ir", "c71414tk.betxane.com", "beauty-tech.de", "wasp.blinqueofficial.com", "duck.bergamonerazzurra.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://testingcf.jsdelivr.net/gh/dsteru3421/02-FD9159F9-9A/4fea-a19d-c354a1aaa4eb"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Legacy Browser Extension Cleanup: An IT administrator manually removes the ClearFake browser extension from a user’s profile during a quarterly hygiene review or after a vendor migration, triggering the IOC match.
  • Filter/Exclusion: Exclude events where the parent process is a known browser executable (e.g., chrome.exe, firefox.exe, msedge.exe) and the action is “delete” or “uninstall” within a specific GPO or admin group.
• Software Distribution via SCCM/Intune: The ClearFake package (or a bundle containing it) is deployed or removed via System Center Configuration Manager (SCCM) or Microsoft Intune as part of a standard software inventory sync, creating file system or registry changes that match the IOC.
  • Filter/Exclusion: Exclude events where the initiating process is CcmExec.exe (SCCM) or IntuneAgent.exe/MdmClient.exe (Intune), or where the source path contains \Appx\ or \ProgramData\Microsoft\Intune\.
• Antivirus Quarantine/Removal: Endpoint Protection (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) detects a known ClearFake component as a PUA (Potentially Unwanted Application) or adware and automatically quarantines or deletes the files, generating a file deletion event that matches the hunt package.
  • Filter/Exclusion: Exclude file deletion events where the parent process is the EDR agent (e.g., MsMpEng.exe, FalconSensor.exe) or where the event type is explicitly “Quarantine” or “Delete” initiated by a security tool.
• User-Initiated Uninstall via Control Panel: A user uninstalls ClearFake through Windows Control Panel > Programs and Features, which invokes unins000.exe or similar uninstaller scripts