This hunt targets the execution of IClickFix, a browser-based exploit that leverages the Windows ShellExecute API to run malicious payloads when users click on specific file types, often bypassing traditional security controls. Proactively hunting for these IOCs in Azure Sentinel is critical because IClickFix can compromise endpoints without user interaction or prior malware presence, allowing adversaries to establish a foothold through common web browsing activities.
Malware Family: IClickFix Total IOCs: 53 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | velvet-otter-glagceis.life | payload_delivery | 2026-09-23 | 100% |
| domain | hollow-forge-rook-guiyn.life | payload_delivery | 2026-09-23 | 100% |
| domain | pemdistribution.com | payload_delivery | 2026-09-23 | 100% |
| domain | focusgood.com | payload_delivery | 2026-09-23 | 100% |
| domain | auroredelsoir.be | payload_delivery | 2026-09-23 | 100% |
| domain | bentnotbrokentherapy.com | payload_delivery | 2026-09-23 | 100% |
| domain | cogessur.com | payload_delivery | 2026-09-23 | 100% |
| domain | dommacchinealimentari.it | payload_delivery | 2026-09-23 | 100% |
| domain | emshousefoundation.org | payload_delivery | 2026-09-23 | 100% |
| domain | aiboerenko.com | payload_delivery | 2026-09-23 | 100% |
| domain | amerikatoursperu.com | payload_delivery | 2026-09-23 | 100% |
| domain | nahobra.com | payload_delivery | 2026-09-23 | 100% |
| domain | powerplyos.com | payload_delivery | 2026-09-23 | 100% |
| domain | productdomains.com | payload_delivery | 2026-09-23 | 100% |
| domain | zerovisual.it | payload_delivery | 2026-09-23 | 100% |
| domain | zilke.com.br | payload_delivery | 2026-09-23 | 100% |
| domain | zimbardi.com.br | payload_delivery | 2026-09-23 | 100% |
| domain | zimcelebsblitz.com | payload_delivery | 2026-09-23 | 100% |
| domain | zionvan.co | payload_delivery | 2026-09-23 | 100% |
| domain | zopzanzibar.org | payload_delivery | 2026-09-23 | 100% |
| domain | zygoteindia.com | payload_delivery | 2026-09-23 | 100% |
| domain | zyoninformatica.com.br | payload_delivery | 2026-09-23 | 100% |
| domain | zyteum.com | payload_delivery | 2026-09-23 | 100% |
| domain | wolfpmb.com | payload_delivery | 2026-09-23 | 100% |
| domain | woodylamp.com | payload_delivery | 2026-09-23 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["velvet-otter-glagceis.life", "hollow-forge-rook-guiyn.life", "pemdistribution.com", "focusgood.com", "auroredelsoir.be", "bentnotbrokentherapy.com", "cogessur.com", "dommacchinealimentari.it", "emshousefoundation.org", "aiboerenko.com", "amerikatoursperu.com", "nahobra.com", "powerplyos.com", "productdomains.com", "zerovisual.it", "zilke.com.br", "zimbardi.com.br", "zimcelebsblitz.com", "zionvan.co", "zopzanzibar.org", "zygoteindia.com", "zyoninformatica.com.br", "zyteum.com", "wolfpmb.com", "woodylamp.com", "worldwild.it", "worldwisepartners.com", "wowkids.co.za", "www-betbhai9.com", "xbazar.it", "xeniapartments.it", "xn--4gqqnz60dt3f.xn--6qq986b3xl", "xoum.com.au", "xtrainerschool.com.br", "xtremelashes.fr", "yellowabscab.com", "yogado.net", "you-skintech.it", "yourhomesf.com", "zakaz.az", "zambellispizza.com.au", "zaratile.com", "zeddd.com", "zenovatech.com", "virtueltime.com", "visasonline.co.za", "visivelgroup.com", "vista-intl.com", "vista.com.vn", "vivianemoura.com.br"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A legacy Java-based enterprise application (e.g., an internal HR portal or financial reporting tool) uses java.awt.Desktop.browse() or similar APIs to open a URL in the default browser. If the URL contains specific path segments or query parameters that match the IClickFix IOC patterns (such as /index.php or specific hash values in the path), the hunt may flag the process creating the temporary internet files or the browser process itself.
java.exe, javaw.exe) and the target URL/path matches the specific legacy application’s known endpoints. Alternatively, exclude the specific java.exe PID if it is running under a service account or a dedicated application pool identity.Scenario: An IT administrator is manually testing a new web-based SaaS application (e.g., a project management tool like Jira or Confluence) by navigating to specific deep links or test pages that use URL structures coinciding with IClickFix IOCs (e.g., paths containing /login, /auth, or specific hash-like strings). The browser or a helper process may create temporary files or execute scripts that trigger the IOC match.
IT_Admins or Service_Accounts group and the process is a standard browser (chrome.exe, msedge.exe, firefox.exe). Additionally, correlate with the user’s recent login history to the specific SaaS application to confirm legitimate access.Scenario: A scheduled PowerShell script or a Sysinternals tool (e.g., PsExec or PsLoggedin) is used to push a configuration update or a small utility to endpoints. If the script downloads a file from a URL that matches an IClickFix IOC (e.g., a CDN path that happens to