This hunt detects adversary activity involving known indicators of compromise (IOCs) from the ThreatFox intelligence feed specifically linked to the IClickFix ecosystem. A SOC team should proactively search for these signals in Azure Sentinel to identify potential lateral movement or data exfiltration attempts that may evade standard rule-based detections.
Malware Family: IClickFix Total IOCs: 25 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | pblmedic.com | payload_delivery | 2026-08-06 | 100% |
| domain | dirtynightmare92.icu | payload_delivery | 2026-08-06 | 100% |
| domain | atomento10.icu | payload_delivery | 2026-08-06 | 100% |
| domain | frontalback91.icu | payload_delivery | 2026-08-06 | 100% |
| domain | hubcert.com.br | payload_delivery | 2026-08-06 | 100% |
| domain | siege-close.com | botnet_cc | 2026-08-06 | 100% |
| url | hxxps://siege-close.com/x9i32md/w1/la02 | botnet_cc | 2026-08-06 | 100% |
| domain | cmaelevadores.com | payload_delivery | 2026-08-06 | 100% |
| domain | elenaargandona.com | payload_delivery | 2026-08-06 | 100% |
| domain | emsaluminium.fr | payload_delivery | 2026-08-06 | 100% |
| domain | encofradosamazon.com | payload_delivery | 2026-08-06 | 100% |
| domain | helpdesk.pushit.it | payload_delivery | 2026-08-06 | 100% |
| domain | joao-martins.com | payload_delivery | 2026-08-06 | 100% |
| domain | karmactive.com | payload_delivery | 2026-08-06 | 100% |
| domain | libella-wordpress.awebi-lab.com | payload_delivery | 2026-08-06 | 100% |
| domain | mail.encofradosamazon.com | payload_delivery | 2026-08-06 | 100% |
| domain | vamoscurtiromelhor.com.br | payload_delivery | 2026-08-06 | 100% |
| domain | www.museoshaghenbeck.mx | payload_delivery | 2026-08-06 | 100% |
| domain | burministr5123.icu | payload_delivery | 2026-08-06 | 100% |
| domain | butterbread1122.icu | payload_delivery | 2026-08-06 | 100% |
| domain | elizium999.digital | payload_delivery | 2026-08-06 | 100% |
| domain | faircloud512421.buzz | payload_delivery | 2026-08-06 | 100% |
| domain | fochinal5123.life | payload_delivery | 2026-08-06 | 100% |
| domain | korichniuu122.icu | payload_delivery | 2026-08-06 | 100% |
| domain | trokkypi512122.icu | payload_delivery | 2026-08-06 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["pblmedic.com", "dirtynightmare92.icu", "atomento10.icu", "frontalback91.icu", "hubcert.com.br", "siege-close.com", "cmaelevadores.com", "elenaargandona.com", "emsaluminium.fr", "encofradosamazon.com", "helpdesk.pushit.it", "joao-martins.com", "karmactive.com", "libella-wordpress.awebi-lab.com", "mail.encofradosamazon.com", "vamoscurtiromelhor.com.br", "www.museoshaghenbeck.mx", "burministr5123.icu", "butterbread1122.icu", "elizium999.digital", "faircloud512421.buzz", "fochinal5123.life", "korichniuu122.icu", "trokkypi512122.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://siege-close.com/x9i32md/w1/la02"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule:
Legitimate Scenario: The enterprise IT Helpdesk team utilizes Microsoft System Center Configuration Manager (SCCM) to deploy a scheduled nightly patching job that downloads and installs the latest IClickFix agent updates from the vendor’s repository. This process triggers network connections to the specific IP addresses and domains listed in the 25 IOCs, mimicking an active threat scan.
SCCM-Deployment-Servers) or filter out events where the Process Name is ccmsetup.exe and the destination port matches the IClickFix update ports (typically 443).Legitimate Scenario: The internal Service Desk performs a weekly automated health check using a custom PowerShell script executed via Task Scheduler. This script queries the IClickFix API to validate ticket synchronization status, generating outbound HTTPS traffic that matches the rule’s IOCs for API endpoints.
svchost.exe (specifically the Schedule service) and the Command Line contains keywords like “IClickFixHealthCheck” or specific script paths located in a known administrative folder (e.g., C:\Scripts\Helpdesk\).Legitimate Scenario: The Security Operations Center (SOC) runs a daily vulnerability assessment using Tenable Nessus, which includes a module specifically designed to verify the configuration and connectivity of third-party ITSM tools like IClickFix. During this scan, Nessus probes the known IOCs to ensure they are reachable and properly configured.