ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt targets the IClickFix attack vector, which exploits browser clickjacking vulnerabilities to execute malicious JavaScript and compromise user sessions without requiring direct user interaction. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as this technique often bypasses traditional perimeter defenses and can lead to credential theft or lateral movement within the environment.

IOC Summary

Malware Family: IClickFix Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["winter-finch-slaibteis.life", "cup.blinqueofficial.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://combeandjasper.com/mx"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Scenario: An IT administrator uses a standard enterprise browser (e.g., Microsoft Edge or Chrome) to validate a new internal web application or test a third-party SaaS integration that utilizes click-to-load iframes or auto-playing media. This legitimate user interaction can trigger the “click” event monitored by IClickFix IOCs, especially if the browser is not fully patched or if the specific IOC checks for known vulnerable versions.

  • Filter/Exclusion: Exclude processes where the parent process is a known, trusted enterprise browser binary (e.g., msedge.exe, chrome.exe) and the user account belongs to a designated “IT Admins” or “QA Testers” security group. Additionally, consider excluding events where the browser version matches the latest stable release known to be patched against IClickFix.

• Scenario: A software deployment tool (such as SCCM, Intune, or Ansible) pushes a browser update or installs a new browser instance (e.g., Firefox, Chromium) to a fleet of endpoints. The installation or update process may temporarily leave the browser in a state where the IOC signatures match, or the deployment script may execute a verification step that mimics the click behavior or checks for the presence of the vulnerable component.

  • Filter/Exclusion: Correlate the alert with recent deployment logs (e.g., SCCM console history or Intune device compliance reports). Exclude alerts if the endpoint has a recorded successful deployment of the browser update within the last 24 hours, or if the process initiating the check is a known deployment agent (e.g., CcmExec.exe, IntuneAgent.exe).

• Scenario: A security team or QA engineer runs a regression test suite or a specific vulnerability scanner (e.g., Qualys, Tenable, or a custom Python script) against internal web services to verify that IClickFix mitigations are in place. These tools