This hunt detects adversary activity by identifying network traffic and endpoint events matching 51 specific Indicators of Compromise (IOCs) linked to the IClickFix threat landscape. A proactive search is essential in Azure Sentinel to rapidly identify potential early-stage compromises or lateral movement attempts associated with this high-severity threat before they escalate into broader incidents.
Malware Family: IClickFix Total IOCs: 51 IOC Types: url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://95[.]164[.]123[.]77:5506/ton.vbs | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://85[.]209[.]129[.]37:5504/ld.bat | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://87[.]120[.]126[.]100/0o1.wav | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://87[.]120[.]126[.]100/kamet1.wav | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://87[.]120[.]126[.]100/mames33.wav | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://87[.]120[.]126[.]100/names22.wav | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://91[.]247[.]36[.]3/immunewait.msi | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://80[.]253[.]249[.]186:5504/cl.bat | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://80[.]253[.]249[.]186:5504/cv.bat | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://80[.]253[.]249[.]186:5504/l.bat | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://80[.]253[.]249[.]186:5504/vm.bat | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://83[.]217[.]209[.]227/2UP.lim | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://83[.]217[.]209[.]227/oay.lim | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://216[.]245[.]184[.]93/bdA.lim | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://45[.]144[.]53[.]136/Vvm.lim | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://45[.]144[.]53[.]136/g0N.lim | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://45[.]43[.]11[.]138:8000/image.png | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://185[.]100[.]157[.]193/Fwp.lim | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://185[.]163[.]204[.]237/2eue.json | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://185[.]163[.]204[.]237/2euesell.wav | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://95[.]164[.]53[.]214:5554/d.bat | botnet_cc | 2026-07-28 | 75% |
| url | hxxps://85[.]209[.]132[.]130/eeroigcukqcpeyat | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://103[.]27[.]156[.]206/most.pdf | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://144[.]31[.]3[.]187/23logo.wav | botnet_cc | 2026-07-28 | 75% |
| url | hxxp://80[.]253[.]249[.]186:5504/ct.bat | botnet_cc | 2026-07-28 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["googlanalitlcs.xyz", "trokuni412.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - IClickFix
let malicious_urls = dynamic(["http://95.164.123.77:5506/ton.vbs", "http://85.209.129.37:5504/ld.bat", "http://87.120.126.100/0o1.wav", "http://87.120.126.100/kamet1.wav", "http://87.120.126.100/mames33.wav", "http://87.120.126.100/names22.wav", "http://91.247.36.3/immunewait.msi", "http://80.253.249.186:5504/cl.bat", "http://80.253.249.186:5504/cv.bat", "http://80.253.249.186:5504/l.bat", "http://80.253.249.186:5504/vm.bat", "http://83.217.209.227/2UP.lim", "http://83.217.209.227/oay.lim", "http://216.245.184.93/bdA.lim", "http://45.144.53.136/Vvm.lim", "http://45.144.53.136/g0N.lim", "http://45.43.11.138:8000/image.png", "http://185.100.157.193/Fwp.lim", "http://185.163.204.237/2eue.json", "http://185.163.204.237/2euesell.wav", "http://95.164.53.214:5554/d.bat", "https://85.209.132.130/eeroigcukqcpeyat", "http://103.27.156.206/most.pdf", "http://144.31.3.187/23logo.wav", "http://80.253.249.186:5504/ct.bat", "http://85.192.48.8/v9L.lim", "http://85.209.129.37:5504/fs.bat", "http://87.120.126.100/007.wav", "http://93.113.25.102/msi/e69378480adab23d", "http://93.152.223.30:5000/uploads/admin/stage2.ps1"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:
Scenario: Scheduled Backup Jobs on Service Accounts
IClickFix-Backup service account (running under a local system or domain admin context) executes nightly backup scripts that query the IClickFix API endpoints. These scripts often initiate outbound connections to known IClickFix cloud URLs which match the rule’s IOCs, triggering alerts during off-hours.svc_iclickfix_backup) or specific hostnames (e.g., SRV-BACKUP-01, SRV-BACKUP-02). Additionally, filter alerts occurring between 02:00 and 05:00 local time on weekdays to align with the backup window.Scenario: Endpoint Protection Scans via CrowdStrike or Microsoft Defender
443 and the process name matches known EDR agents (e.g., C-Drive.exe, MsSense.exe). Alternatively, add the specific IClickFix update server IP ranges to a “Trusted List” within the detection logic to bypass EDR-related noise.Scenario: Admin Maintenance via PowerShell Scripts