ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt targets the IClickFix social engineering technique, where adversaries exploit browser clickjacking to execute malicious payloads without user awareness. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as this method often bypasses traditional perimeter defenses and leads to rapid initial access.

IOC Summary

Malware Family: IClickFix Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["trackerredirect.online", "campaigntracker.icu", "campaigntracker.run", "campaigntracker.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Browser Extension Auto-Update via Service Control Manager (SCM)

  • Scenario: Enterprise endpoint management tools (e.g., SCCM, Intune, or PDQ Deploy) use the sc command or PowerShell New-Service to install or update proprietary browser helper services or security agents (e.g., CrowdStrike Falcon, Zscaler Client Connector) that register as Windows services. If the IOC set includes specific service names or binary paths associated with common enterprise agents, this legitimate provisioning task will trigger the alert.
  • Filter/Exclusion: Exclude alerts where the parent process is a known deployment agent (e.g., CcmExec.exe, IntuneManagementExtension.exe, PDQDeploy.exe) or where the service name matches a whitelist of enterprise-standard agent services (e.g., FalconService, ZscalerService).

• Scheduled Task Creation for Log Rotation or Cleanup

  • Scenario: System administrators create scheduled tasks using schtasks.exe or PowerShell Register-ScheduledTask to perform routine maintenance, such as rotating application logs, clearing temp directories, or running database backups. If the IOC set includes specific task names, triggers, or action commands that resemble IClickFix persistence mechanisms (e.g., tasks running at logon or with specific XML structures), these standard admin jobs will be flagged.
  • Filter/Exclusion: Exclude alerts where the scheduled task owner is a service account (e.g., DOMAIN\svc-maintenance) or where the task path is located in standard enterprise maintenance folders (e.g., \Microsoft\Windows\... or custom \Corp\Maintenance\...) rather than generic user profiles.

• Legitimate Use of rundll32.exe for UI Helper Functions

  • Scenario: Many enterprise applications (e.g., Adobe Creative Suite, Microsoft Office, or Java