This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the IClickFix threat intelligence feed, which may signal active reconnaissance or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of these high-severity signals allows the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration before the adversary establishes a persistent foothold.
Malware Family: IClickFix Total IOCs: 53 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | hoaalliance.org | payload_delivery | 2026-08-01 | 100% |
| domain | leighdogsandcatshome.co.uk | payload_delivery | 2026-08-01 | 100% |
| domain | link-exchange.ws | payload_delivery | 2026-08-01 | 100% |
| domain | luckyladyla.com | payload_delivery | 2026-08-01 | 100% |
| domain | revolttechnology.com | payload_delivery | 2026-08-01 | 100% |
| domain | thecgisite.com | payload_delivery | 2026-08-01 | 100% |
| domain | threeriversinstitute.org | payload_delivery | 2026-08-01 | 100% |
| domain | www.entmedicalservices.org | payload_delivery | 2026-08-01 | 100% |
| domain | www.fourdata.com.au | payload_delivery | 2026-08-01 | 100% |
| domain | www.hanione.co.kr | payload_delivery | 2026-08-01 | 100% |
| domain | www.isvcon.org | payload_delivery | 2026-08-01 | 100% |
| domain | www.kissfromfleur.com | payload_delivery | 2026-08-01 | 100% |
| domain | www.lapirasrl.com | payload_delivery | 2026-08-01 | 100% |
| domain | www.loveforpet.net | payload_delivery | 2026-08-01 | 100% |
| domain | www.mopnantes.fr | payload_delivery | 2026-08-01 | 100% |
| domain | www.pocketfx.net | payload_delivery | 2026-08-01 | 100% |
| domain | www.resultatsdusport.com | payload_delivery | 2026-08-01 | 100% |
| domain | www.sgmltools.org | payload_delivery | 2026-08-01 | 100% |
| domain | www.spacentralbatam.com | payload_delivery | 2026-08-01 | 100% |
| domain | yasabali.com | payload_delivery | 2026-08-01 | 100% |
| domain | smartphony.org | payload_delivery | 2026-08-01 | 100% |
| domain | snyderdailynews.com | payload_delivery | 2026-08-01 | 100% |
| domain | softverb.com | payload_delivery | 2026-08-01 | 100% |
| domain | stillwaternotes.com | payload_delivery | 2026-08-01 | 100% |
| domain | stmarymagdaleneomaha.org | payload_delivery | 2026-08-01 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["hoaalliance.org", "leighdogsandcatshome.co.uk", "link-exchange.ws", "luckyladyla.com", "revolttechnology.com", "thecgisite.com", "threeriversinstitute.org", "www.entmedicalservices.org", "www.fourdata.com.au", "www.hanione.co.kr", "www.isvcon.org", "www.kissfromfleur.com", "www.lapirasrl.com", "www.loveforpet.net", "www.mopnantes.fr", "www.pocketfx.net", "www.resultatsdusport.com", "www.sgmltools.org", "www.spacentralbatam.com", "yasabali.com", "smartphony.org", "snyderdailynews.com", "softverb.com", "stillwaternotes.com", "stmarymagdaleneomaha.org", "tab-solar.com", "taxiaclass.co.uk", "themedscout.com", "tta.org", "visibleintellect.com", "visitballyhoo.com", "vsi-international.com", "wolverinelawn.com", "www.artstrongnyc.com", "www.assetguardpro.com", "www.brignolisrl.com", "www.callys.com", "www.dougwieselman.com", "www.edgeonscience.com", "www.eg-ed.com", "www.elemetalfab.com", "hillrealestate.ca", "kccaldwellcpa.com", "kerrsmithdesign.com", "layer3services.net.au", "lidgardphotography.com", "longviewinnovation.com", "marylandlacrosseshowcase.com", "pandlmasonry.com.au", "petkareanimalsanctuary.ca"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: IClickFix IOCs detection rule:
Scenario: Scheduled Ticket Sync Service Account Activity
IClickFix-Sync scheduled task (running under a dedicated service account like svc_icf_sync) executes nightly to pull new tickets from the IClickFix portal. This process triggers network connections and file reads that match the rule’s IOCs, specifically regarding known IClickFix domain resolutions and API endpoint hits.svc_icf_sync or the host name pattern *IClickFix-Sync* when connecting to the known IClickFix gateway IP range (e.g., 192.168.10.50-54) during the maintenance window of 02:00–04:00 UTC.Scenario: Admin User Running PowerShell Health Checks
Check-IClickFixHealth.ps1) from their workstation to verify API connectivity and token validity. The script invokes Invoke-RestMethod against IClickFix endpoints, generating network flows that align with the 53 IOCs defined in the hunt package.IT_Operations group (e.g., CN=IT_Ops_Group) executing PowerShell processes (powershell.exe) where the command line contains keywords such as “IClickFix”, “API”, or specific endpoint URLs, provided the execution path is located in a trusted admin script directory like C:\Scripts\Ops\.Scenario: Endpoint Protection Scanning of IClickFix Client Cache