This hunt detects adversary activity by identifying network traffic and endpoint events matching 61 specific Indicators of Compromise (IOCs) linked to the IClickFix threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity campaign allows the SOC team to isolate affected assets before lateral movement or data exfiltration occurs.
Malware Family: IClickFix Total IOCs: 61 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | woodpads.ch | payload_delivery | 2026-08-05 | 100% |
| domain | wordstopdf.org | payload_delivery | 2026-08-05 | 100% |
| domain | x-meta.de | payload_delivery | 2026-08-05 | 100% |
| domain | xinflux.com | payload_delivery | 2026-08-05 | 100% |
| domain | yokosdaycare.com | payload_delivery | 2026-08-05 | 100% |
| domain | sudarshanfacilities.in | payload_delivery | 2026-08-05 | 100% |
| domain | svmdamanjodi.org | payload_delivery | 2026-08-05 | 100% |
| domain | thdd.org | payload_delivery | 2026-08-05 | 100% |
| domain | thryvx.com | payload_delivery | 2026-08-05 | 100% |
| domain | tigercredit.io.vn | payload_delivery | 2026-08-05 | 100% |
| domain | timvay.io.vn | payload_delivery | 2026-08-05 | 100% |
| domain | tradesolutions.co.za | payload_delivery | 2026-08-05 | 100% |
| domain | vinhanh.io.vn | payload_delivery | 2026-08-05 | 100% |
| domain | visionverte.org | payload_delivery | 2026-08-05 | 100% |
| domain | vivaylien.io.vn | payload_delivery | 2026-08-05 | 100% |
| domain | perthforkids.com.au | payload_delivery | 2026-08-05 | 100% |
| domain | primesend.online | payload_delivery | 2026-08-05 | 100% |
| domain | puracarespecialisthospital.com | payload_delivery | 2026-08-05 | 100% |
| domain | radioafriquefrance.fr | payload_delivery | 2026-08-05 | 100% |
| domain | roofingcompanyfortlauderdale.com | payload_delivery | 2026-08-05 | 100% |
| domain | roxenemedicale.com | payload_delivery | 2026-08-05 | 100% |
| domain | royalcollectioncigars.com | payload_delivery | 2026-08-05 | 100% |
| domain | skycredit.top | payload_delivery | 2026-08-05 | 100% |
| domain | solarfive.com.au | payload_delivery | 2026-08-05 | 100% |
| domain | southcalnewhomes.com | payload_delivery | 2026-08-05 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["woodpads.ch", "wordstopdf.org", "x-meta.de", "xinflux.com", "yokosdaycare.com", "sudarshanfacilities.in", "svmdamanjodi.org", "thdd.org", "thryvx.com", "tigercredit.io.vn", "timvay.io.vn", "tradesolutions.co.za", "vinhanh.io.vn", "visionverte.org", "vivaylien.io.vn", "perthforkids.com.au", "primesend.online", "puracarespecialisthospital.com", "radioafriquefrance.fr", "roofingcompanyfortlauderdale.com", "roxenemedicale.com", "royalcollectioncigars.com", "skycredit.top", "solarfive.com.au", "southcalnewhomes.com", "spendorstash.com", "luellemag.com", "mattestudio.in", "mnainnovations.com", "moneyja.com.br", "mrcleanandshine.co.uk", "muratilawoffice.me", "nationalbiblebeeng.com", "neworleansdentrepairs.com", "noelwellness.co.uk", "noticias29.com", "nsnnepal.org", "peritdm.com", "goldcoastwebsiteshosting.com.au", "gpsbyte.com", "gt-tours.com", "h5credit.top", "hosts.rntl.nz", "hotrez.de", "isleuthhound.com", "ivay.top", "jennamarsh.com", "klinikrizkangar.com", "desimentenergy.com", "fkd.co.il"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule, along with targeted filtering strategies:
Scheduled Service Account Maintenance Jobs
svc_iclickfix) runs nightly maintenance scripts that query internal asset databases or sync configuration files. These scripts often trigger network connections to known IClickFix endpoints that match the rule’s IOCs, appearing as external reconnaissance but are actually routine housekeeping.Source Account matches svc_iclickfix AND the Process Name is iclickfix-agent.exe (or specific maintenance script names) during off-peak hours (e.g., 02:00–04:00 local time).Endpoint Management Tool Integration
Parent Process is an EDR agent (e.g., FalconSensor.exe, MsMpEng.exe) and the destination IP belongs to the IClickFix update domain range, provided no anomalous user interaction occurred simultaneously.Helpdesk Ticketing System API Calls