ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt targets adversary activity involving specific indicators of compromise linked to the IClickFix platform, which may signal unauthorized access or malicious reconnaissance within the organization’s cloud infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to validate potential threats and mitigate risks before they escalate into broader security incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - IClickFix
let malicious_ips = dynamic(["156.234.7.21", "4.144.235.121"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.234.7.21", "4.144.235.121"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: IClickFix IOCs detection rule, tailored for an enterprise environment using IClickFix for IT service management and asset tracking:

• Scheduled Asset Inventory Synchronization

  • Scenario: The nightly automated job running on the central IClickFix server (e.g., ICF-Sync-01) initiates a bulk synchronization with external hardware inventory databases. This process triggers high-volume outbound connections to known IClickFix cloud endpoints and API gateways, matching the rule’s IOCs.
  • Suggested Filter: Exclude traffic originating from the specific server hostname (ICF-Sync-01) or the dedicated service account svc_icf_inventory during the scheduled maintenance window (e.g., 02:00–04:00 UTC).

• Mobile Field Technician App Updates

  • Scenario: Enterprise field technicians using the IClickFix mobile application on managed devices (via MDM solutions like Microsoft Intune or VMware Workspace ONE) perform background updates or push notification checks. These legitimate app interactions generate network signatures that align with the rule’s IOCs, particularly when accessing the IClickFix CDN for asset images and knowledge base articles.
  • Suggested Filter: Create an exclusion based on the User-Agent string containing IClickFix-Mobile combined with IP ranges assigned to the corporate Wi-Fi SSID or specific MDM-managed device groups.

• Help Desk Agent Dashboard Refreshes

  • Scenario: IT support agents actively using the IClickFix web portal via Microsoft Edge or Chrome frequently refresh dashboards and load complex ticket views containing embedded analytics widgets. These actions trigger repeated HTTP requests to IClickFix static content servers, which may be flagged as suspicious if the volume is high during peak business hours.
  • Suggested Filter: Exclude traffic from the ”