ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts targeting this critical business application. SOC teams should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain potential threats before they escalate into significant security incidents affecting organizational operations.

IOC Summary

Malware Family: IClickFix Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["skiy.mountpopclickgetnow.monster", "leappoploaderinstantly.monster", "verif-key-code.info", "moniskk.live"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Helpdesk Ticket Synchronization Job

  • Context: The enterprise runs a nightly scheduled task (e.g., via Windows Task Scheduler or Azure Automation) that connects to the IClickFix API to sync ticket data. This process generates network traffic matching the rule’s IOCs from a dedicated service account machine.
  • Suggested Filter/Exclusion: Create an exclusion based on the source hostname pattern *TicketSync-Server and restrict the alert trigger to non-business hours (e.g., 01:00–05:00) or exclude specific scheduled task IDs associated with IClickFix integration.

• Scenario: Admin Deployment of IClickFix Updates via SCCM

  • Context: During a major patch cycle, the System Center Configuration Manager (SCCM/MECM) pushes an update to the IClickFix client agents across 500+ workstations. The installation process triggers the specific IOCs defined in the rule as part of the standard software handshake and registry modification.
  • Suggested Filter/Exclusion: Exclude alerts where the source process is ccmsetup.exe or wuauserv.exe (Windows Update Agent) and the destination IP belongs to the IClickFix CDN range, specifically filtering out events tagged with “Application Deployment” in the SCCM logs.

• Scenario: Automated Browser Extension Provisioning for New Hires

  • Context: Upon onboarding new employees, an Intune script automatically installs the IClickFix browser extension (Chrome/Edge) and registers the device. This provisioning step triggers the IOCs as the extension initializes its telemetry connection to the central server.
  • **Suggested Filter/Exclusion