This hypothesis targets the IClickFix exploit, a prevalent social engineering technique that leverages browser clickjacking to execute malicious JavaScript and compromise user sessions without requiring code execution. Proactively hunting for these IOCs in Azure Sentinel is critical because the attack often bypasses traditional perimeter defenses, allowing adversaries to establish footholds in cloud environments through compromised user identities.
Malware Family: IClickFix Total IOCs: 65 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | turboagentsai.com | payload_delivery | 2026-09-26 | 75% |
| domain | urdu.i360.pk | payload_delivery | 2026-09-26 | 75% |
| domain | vasikgo.com | payload_delivery | 2026-09-26 | 75% |
| domain | viacaotriunfo.com.br | payload_delivery | 2026-09-26 | 75% |
| domain | viajanteemserie.com.br | payload_delivery | 2026-09-26 | 75% |
| domain | weeblueranch.com | payload_delivery | 2026-09-26 | 75% |
| domain | wholefamilieshome.com | payload_delivery | 2026-09-26 | 75% |
| domain | wolvshoes.com | payload_delivery | 2026-09-26 | 75% |
| domain | www.deramoimballaggi.it | payload_delivery | 2026-09-26 | 75% |
| domain | www.mixxtees.com | payload_delivery | 2026-09-26 | 75% |
| domain | www.stealthcompliance.com | payload_delivery | 2026-09-26 | 75% |
| domain | www.stonecraftfloors.com | payload_delivery | 2026-09-26 | 75% |
| domain | www.usargentia.it | payload_delivery | 2026-09-26 | 75% |
| domain | xaydungcaitaohomehn.com | payload_delivery | 2026-09-26 | 75% |
| domain | zoharkitchen.co.il | payload_delivery | 2026-09-26 | 75% |
| domain | henanpullur.com | payload_delivery | 2026-09-26 | 75% |
| domain | herczegileander.hu | payload_delivery | 2026-09-26 | 75% |
| domain | hsiddiquemdpa.com | payload_delivery | 2026-09-26 | 75% |
| domain | hydromappers.com | payload_delivery | 2026-09-26 | 75% |
| domain | icemanservices.uk | payload_delivery | 2026-09-26 | 75% |
| domain | initcomplv.ma | payload_delivery | 2026-09-26 | 75% |
| domain | innolife.com.vn | payload_delivery | 2026-09-26 | 75% |
| domain | kaiice.com | payload_delivery | 2026-09-26 | 75% |
| domain | kinnarijain.com | payload_delivery | 2026-09-26 | 75% |
| domain | knitasst.com | payload_delivery | 2026-09-26 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["turboagentsai.com", "urdu.i360.pk", "vasikgo.com", "viacaotriunfo.com.br", "viajanteemserie.com.br", "weeblueranch.com", "wholefamilieshome.com", "wolvshoes.com", "www.deramoimballaggi.it", "www.mixxtees.com", "www.stealthcompliance.com", "www.stonecraftfloors.com", "www.usargentia.it", "xaydungcaitaohomehn.com", "zoharkitchen.co.il", "henanpullur.com", "herczegileander.hu", "hsiddiquemdpa.com", "hydromappers.com", "icemanservices.uk", "initcomplv.ma", "innolife.com.vn", "kaiice.com", "kinnarijain.com", "knitasst.com", "lastpointtrading.com", "legale-mischung.net", "lizzardinsure.co.za", "mabupal.com.pe", "mehraeenlawfirm.com", "mogi.com.ng", "munibalanya.gob.gt", "my-hosting.co.il", "naturliebgaerten.de", "nayz.co.id", "neurowellcounseling.com", "parfumerie-elegance.tn", "riyadh-house.com", "softivox.com", "solareda.ro", "techtifiedsolutions.com", "theleonsjacket.com", "advanta-realestate.de", "amazingfitness.co.za", "ambassadorolubejide.com", "astrumsteel.com", "autumntextile.com", "bhpbusiness.pl", "buildersbliss.ca", "celine-gronek.fr"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A developer or DevOps engineer uses a standard GUI-based text editor (e.g., Notepad++, VS Code, or WordPad) to open and edit a configuration file, log file, or script that was downloaded from a public repository or shared drive. If the file contains specific HTML entities or Unicode characters that IClickFix exploits (such as & or specific zero-width spaces) and the editor renders them in a way that triggers the click event, the IOCs may match.
notepad.exe, code.exe, devenv.exe, wordpad.exe) from the IOC matching logic, or restrict the detection to non-interactive processes (e.g., exclude if the parent process is a known GUI application).Scenario: An IT administrator uses a browser-based tool or a local HTML viewer to preview a web page or documentation file that includes interactive elements or specific CSS/JS constructs used in IClickFix payloads. If the preview tool executes JavaScript or handles click events in a non-standard way, it may trigger the behavioral or signature-based IOCs.
mshtml.dll hosted by explorer.exe in a specific context, or dedicated preview tools like brave.exe, chrome.exe when opened via a specific file association) if the detection relies on process execution rather than pure file hash matching. Alternatively, exclude if the parent process is a known browser or preview utility.Scenario: A security team or QA engineer runs a test suite or a custom script that intentionally creates or manipulates files with known IClickFix IOCs (e.g., for regression testing or IOC validation). These test files are often stored in a dedicated test directory