ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts. A SOC team should proactively search for these IOCs within Azure Sentinel to rapidly identify and contain potential threats before they escalate into broader security incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 6 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["housemill9911.digital", "checkinguscapgo.com", "providercommunications.com.au", "roofvo.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["https://fsdmkfskdojyttt.pro/uuee.js", "https://roofvo.com/wp-links-cat.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: IClickFix IOCs detection rule:

• Scheduled Helpdesk Ticket Sync Job

  • Scenario: The enterprise utilizes a nightly automated script (e.g., via PowerShell or Azure Automation) that connects to the IClickFix API to sync ticket metadata. This process generates network traffic matching the IOCs during off-hours, often appearing as an unexpected external connection from a server account.
  • Filter/Exclusion: Create an exclusion for the specific source IP address of the synchronization server (e.g., 10.20.5.45) and restrict the rule trigger to business hours only (08:00–18:00) or exclude traffic originating from the “Service_Account_Sync” user identity.

• ITSM Integration with Microsoft Teams

  • Scenario: The organization has a deep integration where IClickFix pushes notifications and updates directly into Microsoft Teams channels. When an admin triggers a bulk update or a new workflow is deployed, the Teams client (or the backend gateway) initiates connections to IClickFix endpoints that match the detection IOCs.
  • Filter/Exclusion: Exclude traffic originating from the specific application identity “Microsoft Teams” on the host where the integration service runs, or filter out destination ports commonly used by the Teams gateway if the IOC matches a specific port range (e.g., Port 443 traffic to iclickfix.com from the Teams Gateway IP).

• Admin User Performing Bulk Asset Onboarding

  • Scenario: An IT administrator manually uses the IClickFix web portal or desktop agent to onboard a large batch of new hardware assets. This action triggers multiple sequential API calls and data uploads that hit all 6 IOCs within a short timeframe, mimicking a potential lateral movement or beaconing attack pattern.