ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate affected assets and mitigate potential supply chain risks before they escalate into broader security incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["zewaplus.club", "telemetryworks.pro", "burunduktracker.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule:

• Scenario 1: Scheduled Maintenance and Backup Jobs

  • Context: The enterprise runs nightly automated backups or database maintenance scripts on the IClickFix application server (e.g., using sqlagent or cron jobs) that trigger network connections to IClickFix update servers. These scheduled tasks often match the IOCs associated with software updates or telemetry.
  • Filter/Exclusion: Exclude alerts where the source process is a known service account (e.g., SYSTEM, NT SERVICE\IClickFixSvc) and the execution time falls within the maintenance window (e.g., 02:00–04:00 daily). Add a filter for specific scheduled task names like “IClickFix_Daily_Health_Check”.

• Scenario 2: Admin-Initiated Software Updates via Endpoint Management

  • Context: System administrators use tools like Microsoft Intune, SCCM (Configuration Manager), or Jamf to push IClickFix agent updates across the fleet. During these deployments, the agents connect to the IClickFix distribution points, generating traffic that matches the rule’s IOCs but represents a legitimate administrative action rather than a threat.
  • Filter/Exclusion: Create an exclusion for events where the parent process is msiexec.exe, ccmsetup.exe (SCCM), or IntuneManagementExtension.exe. Additionally, filter out alerts where the user context is DOMAIN\AdminGroup and the action type is “Software Update” or “Deployment”.

• Scenario 3: Legitimate Help Desk Ticketing Integration

  • Context: The organization has integrated IClickFix with its primary IT Service Management (ITSM) platform, such as ServiceNow,