ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hypothesis targets the IClickFix malware family, a downloader that leverages browser-based clickjacking to establish command-and-control channels for data exfiltration. Proactively hunting for these IOCs in Azure Sentinel is critical because IClickFix often bypasses traditional email gateways by exploiting user interaction, making early detection essential to prevent lateral movement and persistent C2 establishment within the environment.

IOC Summary

Malware Family: IClickFix Total IOCs: 7 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["skaedbraearaquiet.life", "cabskaiyn-crane.life", "zigelpi12.life", "cloudflare.bot", "laroverestore.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://skaedbraearaquiet.life/t.js?site=2f702398a34ef46cb995c4f4e89c6407", "https://skaedbraearaquiet.life/ext-b.4f9db6afd06a.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Scenario: A marketing team uses a legitimate third-party click-tracking or analytics plugin (e.g., Hotjar, Clicky, or a custom JavaScript snippet) that dynamically injects iframes or loads external resources from known ThreatFox IClickFix domains to verify click attribution or load ad scripts.

  • Filter/Exclusion: Exclude alerts where the parent process is a web browser (chrome.exe, msedge.exe, firefox.exe) and the user agent string contains “ClickTrack” or “Analytics”, or exclude specific known-good subdomains of the IOC domain that are whitelisted in the corporate DNS/Proxy allowlist for marketing tools.

• Scenario: An IT administrator performs a manual security assessment or penetration test using a tool like curl or wget to verify network reachability to a newly identified IClickFix C2 domain before adding it to the blocklist, or uses a browser to inspect the landing page for certificate validation.

  • Filter/Exclusion: Exclude alerts originating from service accounts tagged with SecurityTeam or PenTest in the Active Directory group membership, or exclude connections where the source IP is within the designated “Security Lab” subnet (e.g., 10.20.0.0/24).

• Scenario: A developer or QA engineer tests a new web application feature that involves dynamic content loading from a CDN or third-party service that happens to host assets on a domain previously associated with IClickFix (due to domain reuse or shared infrastructure), triggering the IOC match during UAT (User Acceptance Testing).

  • Filter/Exclusion: Exclude alerts where the source host is tagged with Dev or QA in the CMDB, or where the user account belongs to the Developers or QA_Team AD group, and the connection occurs during business hours on weekdays.

• **Scenario