ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts within the organization’s ecosystem. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate potential threats before they escalate into broader security incidents affecting sensitive business operations.

IOC Summary

Malware Family: IClickFix Total IOCs: 5 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["yamin4d.org", "aaa.akoraofficial.com", "analysis-id-fmd.info", "maletosr.world", "brusketaa.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The Enterprise Service Desk utilizes Microsoft Endpoint Configuration Manager (SCCM) or Intune to push the latest IClickFix agent updates. During these scheduled deployment windows, the installer process (IClickFixSetup.exe) generates network traffic matching the rule’s IOCs as it contacts the update server and registers with the backend.
  • Filter/Exclusion: Create a whitelist entry for the specific hash of the IClickFixSetup.exe executable located in the standard installation directory (e.g., C:\Program Files\IClickFix\). Additionally, exclude traffic originating from the SCCM Management Point server IP range during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Scheduled Data Synchronization Job

  • Context: A nightly Windows Task Scheduler job runs to sync local ticketing data with the IClickFix cloud repository. This process, often triggered by a PowerShell script (Sync-IClickFixData.ps1), initiates outbound HTTPS connections that match the IOCs for “data exfiltration” or “cloud connectivity.”
  • Filter/Exclusion: Exclude alerts where the parent process is svchost.exe (specifically the TaskScheduler service) or powershell.exe running under a dedicated service account (e.g., svc-iclickfix-sync). Ensure the destination URL matches the official IClickFix domain (*.iclickfix.com) and restricts the alert to the specific time window of 01:00–03:00 local time.

• **Scenario: Admin Manual