This hunt targets the IClickFix exploit, a social engineering technique that leverages browser clickjacking to execute arbitrary code and establish a foothold without user interaction. Proactively hunting for these IOCs in Azure Sentinel is critical because this high-severity vector can bypass traditional perimeter defenses and compromise endpoints through simple user clicks, often leading to rapid lateral movement and data exfiltration.
Malware Family: IClickFix Total IOCs: 33 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | winsochacoon.com | payload_delivery | 2026-09-24 | 100% |
| domain | wyndhamgardenzomin.com | payload_delivery | 2026-09-24 | 100% |
| domain | tokai-yokosuka.co.jp | payload_delivery | 2026-09-24 | 100% |
| domain | transpau.com.br | payload_delivery | 2026-09-24 | 100% |
| domain | trypzomin.com | payload_delivery | 2026-09-24 | 100% |
| domain | vanremoorterebv.be | payload_delivery | 2026-09-24 | 100% |
| domain | videobuddyapk.com.in | payload_delivery | 2026-09-24 | 100% |
| domain | techcloudltd.work | payload_delivery | 2026-09-24 | 100% |
| domain | sync-dejavu.de | payload_delivery | 2026-09-24 | 100% |
| domain | raideurs.eu | payload_delivery | 2026-09-24 | 100% |
| domain | ramadaencorezomin.com | payload_delivery | 2026-09-24 | 100% |
| domain | pepeshop.net | payload_delivery | 2026-09-24 | 100% |
| domain | niroosalamat.com | payload_delivery | 2026-09-24 | 100% |
| domain | oceandriveshipchandlers.com | payload_delivery | 2026-09-24 | 100% |
| domain | oceanpromarineservices.com | payload_delivery | 2026-09-24 | 100% |
| domain | oranjeverenigingenter.nl | payload_delivery | 2026-09-24 | 100% |
| domain | multiservicios.limpiezasmartin.es | payload_delivery | 2026-09-24 | 100% |
| domain | nicom-ukraine.com | payload_delivery | 2026-09-24 | 100% |
| domain | nicomukraine.com | payload_delivery | 2026-09-24 | 100% |
| domain | mediaworld-lb.com | payload_delivery | 2026-09-24 | 100% |
| domain | leivamosetasdecadiz.es | payload_delivery | 2026-09-24 | 100% |
| domain | hielosnorteonline.com | payload_delivery | 2026-09-24 | 100% |
| domain | iriskw.com | payload_delivery | 2026-09-24 | 100% |
| domain | for88.fun | payload_delivery | 2026-09-24 | 100% |
| domain | ebutic.com | payload_delivery | 2026-09-24 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["winsochacoon.com", "wyndhamgardenzomin.com", "tokai-yokosuka.co.jp", "transpau.com.br", "trypzomin.com", "vanremoorterebv.be", "videobuddyapk.com.in", "techcloudltd.work", "sync-dejavu.de", "raideurs.eu", "ramadaencorezomin.com", "pepeshop.net", "niroosalamat.com", "oceandriveshipchandlers.com", "oceanpromarineservices.com", "oranjeverenigingenter.nl", "multiservicios.limpiezasmartin.es", "nicom-ukraine.com", "nicomukraine.com", "mediaworld-lb.com", "leivamosetasdecadiz.es", "hielosnorteonline.com", "iriskw.com", "for88.fun", "ebutic.com", "eduteka.co", "cowboytrick.dk", "cedipay.cash", "alwesam.org", "apttechservices.com", "atladeshellenicdivers.com", "bakry.me", "alphasolar-lb.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: Enterprise Endpoint Management Agents (e.g., Microsoft Endpoint Configuration Manager, Intune, or SCCM) executing standard software deployment or inventory scripts that interact with the browser’s navigator object or perform click-to-run installations.
CcmExec.exe, MsMpEng.exe, IntuneAgent.exe) and the command line contains standard deployment keywords like /deploy, /install, or /inventory.Scenario: Automated UI Testing Frameworks (e.g., Selenium, Cypress, or Playwright) running in CI/CD pipelines or developer workstations that simulate user clicks to validate web application functionality, potentially triggering IOCs related to click events or specific URL patterns.
ci-cd, dev-test, or qa environments, or filter out processes where the parent is a Node.js runtime (node.exe) or Java runtime (java.exe) associated with test frameworks, and the user context is a service account (e.g., CI_Bot, TestUser).Scenario: Browser Extension Management or Policy Deployment where Group Policy Objects (GPOs) or MDM profiles push browser extensions or settings, causing the browser process to execute initialization scripts that may match IOC patterns for click handling or plugin loading.
gpupdate.exe or gpedit.msc, or where the browser process (chrome.exe, msedge.exe, firefox.exe) is launched with command-line flags indicating policy application (e.g., --policy, --load-extension), and the user is a domain admin or service account.Scenario: Legacy Line-of-Business (LOB) Web Applications that rely on older JavaScript frameworks or