This hunt detects adversary activity by correlating network and endpoint telemetry against a curated set of 124 known indicators of compromise (IOCs) specific to the IClickFix threat landscape. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage intrusions or lateral movement attempts that may have evaded standard automated detections, ensuring rapid containment before broader impact occurs.
Malware Family: IClickFix Total IOCs: 124 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | zerodansleau.fr | payload_delivery | 2026-07-29 | 100% |
| domain | zeronervepain.com | payload_delivery | 2026-07-29 | 100% |
| domain | ziegler-partner.eu | payload_delivery | 2026-07-29 | 100% |
| domain | www.victorthompsonmusic.com | payload_delivery | 2026-07-29 | 100% |
| domain | www.video-evenementielle.fr | payload_delivery | 2026-07-29 | 100% |
| domain | www.villaadimari.it | payload_delivery | 2026-07-29 | 100% |
| domain | www.workwings.nl | payload_delivery | 2026-07-29 | 100% |
| domain | www.ylc.ro | payload_delivery | 2026-07-29 | 100% |
| domain | www.zelvito.com | payload_delivery | 2026-07-29 | 100% |
| domain | www.zonnebrillenshop.nl | payload_delivery | 2026-07-29 | 100% |
| domain | wyndham.thanhlongbay.vn | payload_delivery | 2026-07-29 | 100% |
| domain | xn--80ae3ajjh.xn--p1ai | payload_delivery | 2026-07-29 | 100% |
| domain | xn--96-6kchpsw1brcl.xn--p1ai | payload_delivery | 2026-07-29 | 100% |
| domain | xn--b6bel7a3an0g.com | payload_delivery | 2026-07-29 | 100% |
| domain | xn--edelmetallhndler-werden-57b.de | payload_delivery | 2026-07-29 | 100% |
| domain | xvertuz.com | payload_delivery | 2026-07-29 | 100% |
| domain | yogatherapy.co.il | payload_delivery | 2026-07-29 | 100% |
| domain | yusntech.com | payload_delivery | 2026-07-29 | 100% |
| domain | yvzkids.com | payload_delivery | 2026-07-29 | 100% |
| domain | zaloharcpohoda.webproukazku.cz | payload_delivery | 2026-07-29 | 100% |
| domain | www.procleanair.ch | payload_delivery | 2026-07-29 | 100% |
| domain | www.refiktur.com | payload_delivery | 2026-07-29 | 100% |
| domain | www.residences-anna.com | payload_delivery | 2026-07-29 | 100% |
| domain | www.rocklocalseo.com | payload_delivery | 2026-07-29 | 100% |
| domain | www.silentcroc.com | payload_delivery | 2026-07-29 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["zerodansleau.fr", "zeronervepain.com", "ziegler-partner.eu", "www.victorthompsonmusic.com", "www.video-evenementielle.fr", "www.villaadimari.it", "www.workwings.nl", "www.ylc.ro", "www.zelvito.com", "www.zonnebrillenshop.nl", "wyndham.thanhlongbay.vn", "xn--80ae3ajjh.xn--p1ai", "xn--96-6kchpsw1brcl.xn--p1ai", "xn--b6bel7a3an0g.com", "xn--edelmetallhndler-werden-57b.de", "xvertuz.com", "yogatherapy.co.il", "yusntech.com", "yvzkids.com", "zaloharcpohoda.webproukazku.cz", "www.procleanair.ch", "www.refiktur.com", "www.residences-anna.com", "www.rocklocalseo.com", "www.silentcroc.com", "www.sobatbangilan.com", "www.solentinecosmetica.com", "www.soolah.com", "www.strategicgamedesigner.com", "www.sudeventishow.it", "www.tekamousa.com", "www.tiptoes.co.uk", "www.town-labs.com", "www.traveltodubai.ae", "www.triumphspitfire.eu", "www.ultimax-perform.fr", "www.usgeneralservices.com", "www.lmsprinting.co.uk", "www.lovetospa.com", "www.massatelier-dresden.de", "www.mediation.brussels", "www.metalhefesto.com", "www.mvihtrucks.com", "www.mycelebritybookings.com", "www.newlifeliveaboard.com", "www.ntpardavimai.lt", "www.ofwd.com", "www.onironautica.it", "www.optimaingenieria.co", "www.p2p.rs"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule:
Scheduled Service Health Checks by IClickFix Agents
ICFService.exe) performs automated connectivity checks against the central server or external update repositories every 15 minutes. These scheduled jobs generate network traffic and DNS queries that match the rule’s IOCs (specifically IP ranges and domain names used for telemetry).DOMAIN\ICF-Service) or filter out connections where the source process name is exactly ICFService.exe running on endpoints within the “HelpDesk” OU.Patch Deployment via Microsoft Endpoint Configuration Manager (SCCM)
ccmsetup.exe or wuauserv.exe, and the destination IP belongs to the known IClickFix CDN range.Admin-Initiated Manual Ticket Resolution via Web Portal
https://admin.iclickfix.com) from their corporate laptops to resolve complex tickets or configure new workflows. This activity triggers DNS resolution and HTTPS connections that align with the rule’s domain IOCs, often occurring outside of standard automated job times.