ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the IClickFix threat landscape, which may signal active reconnaissance or initial access attempts within the environment. Proactively hunting for these 47 IOCs in Azure Sentinel is critical to identify early-stage threats and mitigate potential high-severity risks before they escalate into broader incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 47 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	adj-tech.mx	payload_delivery	2026-07-23	100%
domain	angular-engenharia.com.br	payload_delivery	2026-07-23	100%
domain	archi3d.co.uk	payload_delivery	2026-07-23	100%
domain	ashtagmarketing.co.za	payload_delivery	2026-07-23	100%
domain	biagiottimatteo.it	payload_delivery	2026-07-23	100%
domain	calacosta.com	payload_delivery	2026-07-23	100%
domain	capitolosfera.it	payload_delivery	2026-07-23	100%
domain	cloudyday.nl	payload_delivery	2026-07-23	100%
domain	clubcanin-loctudy.fr	payload_delivery	2026-07-23	100%
domain	dailycode.dev	payload_delivery	2026-07-23	100%
domain	denvercasado.com	payload_delivery	2026-07-23	100%
domain	design77.org	payload_delivery	2026-07-23	100%
domain	designsbymeinc.com	payload_delivery	2026-07-23	100%
domain	djmaurinho.com.br	payload_delivery	2026-07-23	100%
domain	finishedimage.co.za	payload_delivery	2026-07-23	100%
domain	generationelle.com	payload_delivery	2026-07-23	100%
domain	hansu.nl	payload_delivery	2026-07-23	100%
domain	highsteel.net.au	payload_delivery	2026-07-23	100%
domain	jconnan.com	payload_delivery	2026-07-23	100%
domain	jie-lin.com	payload_delivery	2026-07-23	100%
domain	jonrook.com	payload_delivery	2026-07-23	100%
domain	kfcom.com.br	payload_delivery	2026-07-23	100%
domain	kuchenna.pl	payload_delivery	2026-07-23	100%
domain	kwiaciarniaem.pl	payload_delivery	2026-07-23	100%
domain	leprintexpress.com	payload_delivery	2026-07-23	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["adj-tech.mx", "angular-engenharia.com.br", "archi3d.co.uk", "ashtagmarketing.co.za", "biagiottimatteo.it", "calacosta.com", "capitolosfera.it", "cloudyday.nl", "clubcanin-loctudy.fr", "dailycode.dev", "denvercasado.com", "design77.org", "designsbymeinc.com", "djmaurinho.com.br", "finishedimage.co.za", "generationelle.com", "hansu.nl", "highsteel.net.au", "jconnan.com", "jie-lin.com", "jonrook.com", "kfcom.com.br", "kuchenna.pl", "kwiaciarniaem.pl", "leprintexpress.com", "marianabertelli.com", "martamartinezvet.com", "mateuszchwalisz.pl", "photovideosound.com", "putti.lv", "radioradiosa.it", "rayyau.net", "hlks.net", "imagerymontana.com", "imperadoruniformes.com.br", "sergiosworldbeers.com", "showkontor.de", "sigarv.se", "solaron-projekte.de", "swodeck.com", "taginfant.com", "teambluewhitezuerich.ch", "thestudiodesign.com", "totalpackagelandscape.com", "totulpentrufunerare.ro", "vitamina.ppg.br", "vpaaconsulting.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — IClickFix

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: IClickFix IOCs detection rule:

• Scenario: Scheduled Service Health Checks by IT Operations

  • Context: The enterprise’s automated monitoring suite (e.g., SolarWinds NPM or PRTG) runs hourly connectivity tests against the IClickFix application servers. These health checks initiate outbound connections to specific IClickFix endpoints that match the rule’s IOCs, triggering alerts despite being routine maintenance.
  • Filter/Exclusion: Create a whitelist exclusion for the source IP ranges of the monitoring servers (e.g., 10.20.45.0/24) when communicating with destination ports associated with IClickFix health endpoints. Alternatively, add a condition to exclude events occurring during the defined maintenance window (e.g., 02:00–03:00 UTC daily).

• Scenario: Admin-Initiated Knowledge Base Synchronization

  • Context: During peak business hours, the Service Desk Manager executes a manual synchronization job via the IClickFix Administrator Portal to update knowledge base articles and ticket templates. This process generates multiple API calls and file transfers that align with the 47 IOCs in the hunt package, mimicking potential data exfiltration or remote access anomalies.
  • Filter/Exclusion: Implement a user-based exclusion for specific administrative accounts (e.g., svc-iclickfix-admin or IT-Support-Lead) when they initiate traffic to known IClickFix API gateways. The filter should correlate the event with the “Knowledge Sync” application tag in the log metadata.

• Scenario: Third-Party Integration Webhooks from CRM Systems

  • Context: The organization’s Salesforce or ServiceNow instance sends real-time webhooks to