This hunt detects adversary activity by identifying network traffic and endpoint events matching the specific Indicators of Compromise (IOCs) associated with the IClickFix threat intelligence feed. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify potential compromises from this known campaign, enabling faster containment before adversaries can establish persistence or exfiltrate sensitive data.
Malware Family: IClickFix Total IOCs: 61 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | jouwonderhoud.be | payload_delivery | 2026-08-01 | 100% |
| domain | www.cevrev.com | payload_delivery | 2026-08-01 | 100% |
| domain | www.cobelediciones.com | payload_delivery | 2026-08-01 | 100% |
| domain | www.consultaway.com | payload_delivery | 2026-08-01 | 100% |
| domain | www.passiontennis.be | payload_delivery | 2026-08-01 | 100% |
| domain | www.pepgateway.com.au | payload_delivery | 2026-08-01 | 100% |
| domain | www.seachangesummerparty.org | payload_delivery | 2026-08-01 | 100% |
| domain | frontlineaids.org | payload_delivery | 2026-08-01 | 100% |
| domain | glitz.beautyinsider.my | payload_delivery | 2026-08-01 | 100% |
| domain | hobsonville.werun.nz | payload_delivery | 2026-08-01 | 100% |
| domain | ilovepadel.eu | payload_delivery | 2026-08-01 | 100% |
| domain | ktkdqt.ftu.edu.vn | payload_delivery | 2026-08-01 | 100% |
| domain | kulturlandleben.at | payload_delivery | 2026-08-01 | 100% |
| domain | lionsz.de | payload_delivery | 2026-08-01 | 100% |
| domain | luattrungtin.com | payload_delivery | 2026-08-01 | 100% |
| domain | moldearq.com.ar | payload_delivery | 2026-08-01 | 100% |
| domain | moveestimator.ca | payload_delivery | 2026-08-01 | 100% |
| domain | noladeadspace.com | payload_delivery | 2026-08-01 | 100% |
| domain | ogweb.fr | payload_delivery | 2026-08-01 | 100% |
| domain | premieimoveis.com | payload_delivery | 2026-08-01 | 100% |
| domain | propmech.com | payload_delivery | 2026-08-01 | 100% |
| domain | role.com.tw | payload_delivery | 2026-08-01 | 100% |
| domain | shropshirescalemodellers.uk | payload_delivery | 2026-08-01 | 100% |
| domain | sport-freak.de | payload_delivery | 2026-08-01 | 100% |
| domain | stadtsys.com | payload_delivery | 2026-08-01 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["jouwonderhoud.be", "www.cevrev.com", "www.cobelediciones.com", "www.consultaway.com", "www.passiontennis.be", "www.pepgateway.com.au", "www.seachangesummerparty.org", "frontlineaids.org", "glitz.beautyinsider.my", "hobsonville.werun.nz", "ilovepadel.eu", "ktkdqt.ftu.edu.vn", "kulturlandleben.at", "lionsz.de", "luattrungtin.com", "moldearq.com.ar", "moveestimator.ca", "noladeadspace.com", "ogweb.fr", "premieimoveis.com", "propmech.com", "role.com.tw", "shropshirescalemodellers.uk", "sport-freak.de", "stadtsys.com", "starseedschangingtheworld.com", "websites24.co.uk", "www.audreyguyonphotographe.fr", "www.bonsaibasics.com", "www.cateringbykellys.com", "andariega.me", "apbtship.ch", "brand-hand.ru", "corecontent.no", "diezdedos.eu", "dragonapartments.wales", "eddan.is", "fbcbentonville.org", "junnun.com", "wacadvisors.com", "makcubes.com", "marblelineinc.com", "masap.fr", "mavericklabs.io", "maximumsecurityinc.net", "meldsys.co.uk", "muscleandmotion.com", "myfinanzplaner.de", "narcopoliticos.com", "nomisfulstore.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Automated Helpdesk Ticket Creation via Service Account
ICLFX-SVC service account automatically creates new tickets in the IClickFix portal during business hours. This triggers network connections to known IClickFix IOCs (e.g., specific API endpoints or update servers) which the rule flags as potential external communication from a standard workstation.DOMAIN\ICLFX-SVC and the destination port matches the IClickFix API range (typically 443). Alternatively, add a rule exclusion for any process named iclickfix.exe running under this specific service account.Scenario: Scheduled Patch Deployment by SCCM/Intune
ccmexec.exe (SCCM) or Microsoft.IntuneManagementService.exe.Scenario: Admin-Initiated Bulk Data Import