ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hypothesis targets the execution of known IClickFix indicators, a technique where adversaries exploit user trust in legitimate software to achieve code execution without requiring elevated privileges. Proactively hunting for these IOCs in Azure Sentinel is critical because IClickFix often bypasses traditional perimeter defenses by leveraging standard user interactions, allowing attackers to establish a foothold in endpoints that appear otherwise secure.

IOC Summary

Malware Family: IClickFix Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["kiln-skioi-c29up.com", "trilliot6776.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

• Legitimate Web UI Automation and Testing: Enterprise QA teams or DevOps engineers using browser automation frameworks (e.g., Selenium, Puppeteer, or Playwright) to test internal dashboards or SSO portals may trigger click-based IOCs if the automation script simulates mouse clicks on specific UI elements that match the ThreatFox signatures.

  • Filter/Exclusion: Exclude processes associated with known automation drivers (e.g., chromedriver.exe, geckodriver.exe, node.exe running test scripts) or limit the rule to non-interactive user sessions where the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe).

• RPA (Robotic Process Automation) Bot Execution: Business process automation bots (e.g., UiPath, Blue Prism, or Automation Anywhere) that perform data entry or navigation tasks on internal web applications may generate click events that align with IClickFix IOCs, particularly if they interact with legacy forms or untrusted third-party widgets embedded in intranet pages.

  • Filter/Exclusion: Exclude processes belonging to RPA platforms (e.g., UiPath.exe, BluePrism.exe, AutomationAnywhere.exe) or filter by user accounts designated as service accounts for RPA bots (e.g., svc-rpa-bot01).

• Scheduled Backup or Sync Jobs with Web Components: Scheduled tasks (e.g., via Windows Task Scheduler or cron) that run backup or sync tools with web-based configuration interfaces (e.g., Veeam, Commvault, or custom Python scripts using selenium for state verification) might trigger the rule if the automation interacts with web elements during the job execution.

  • Filter/Exclusion: Exclude processes spawned by scheduled task runners (e.g., Svchost.exe hosting specific services, python.exe with