ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt detects adversary activity by matching network and endpoint telemetry against specific indicators of compromise (IOCs) linked to the ClearFake threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because ClearFake employs sophisticated evasion techniques that may bypass standard signature-based detections, requiring manual investigation to identify early-stage compromises.

IOC Summary

Malware Family: ClearFake Total IOCs: 13 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["ixejqlu.wavelu.com", "zhdten.paparomanospizzaclintontownship.com", "crcmb1nm.goodangpao.com", "acisvwr.zodiacsmoke.com", "zodiacsmoke.com", "hkbtnx.pamsribbonsandroses.com", "iswypre.zalabia.net", "zalabia.net", "dcgnyc.nathanaelappliances.com", "hngbkm.wifewithabudget.com", "wifewithabudget.com", "ydmtrvn.zagspizzamenu.com", "zagspizzamenu.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment:

• Scenario: Security Team Manual IOC Ingestion via Threat Intelligence Platform

  • Context: The SOC team manually imports a curated list of ClearFake indicators (hashes, domains) into the organization’s SIEM or Threat Intelligence platform (e.g., Tenable One, CrowdStrike Falcon Insight, or Microsoft Defender for Cloud Apps) to update global block lists. This ingestion process triggers network traffic or file hash matches against the rule’s 13 IOCs.
  • Suggested Filter: Exclude events where the source hostname contains siem-ingest, threat-intel-sync, or specific service accounts used by the threat intelligence platform (e.g., svc_ti_sync). Additionally, filter out traffic originating from the Security Operations Center (SOC) subnet IP range.

• Scenario: Scheduled Antivirus Definition and Reputation Updates

  • Context: Enterprise endpoint protection solutions like Microsoft Defender for Endpoint, Symantec Endpoint Protection, or Carbon Black perform scheduled daily updates to their reputation databases. During these windows, the agents may query or download ClearFake IOCs from vendor update servers, generating file creation or network connection logs that match the detection logic.
  • Suggested Filter: Create an exclusion based on the Process Name being the specific AV updater service (e.g., MsMpSvc.exe, Symantec Antivirus Update Service) and restrict the rule to trigger only outside of standard maintenance windows (e.g., 02:00–04:00 UTC). Alternatively, exclude traffic destined for known vendor update domains (e.g., *.microsoft.com or *.symantec.com).

• Scenario: Automated Compliance and Audit Scanning Jobs

  ---