ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IClickFix platform, which may signal unauthorized access or data exfiltration attempts. A SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify and contain potential threats leveraging this known ecosystem before they escalate into broader security incidents.

IOC Summary

Malware Family: IClickFix Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["volrko.pro", "testmyopinion.live", "ownnewstoday.live"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — IClickFix

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: IClickFix IOCs detection rule in an enterprise environment:

• Scheduled Backup Jobs on File Servers: Enterprise file servers often run nightly backup scripts that utilize IClickFix agents to archive ticket data or sync configuration files. These scheduled tasks (e.g., running via Windows Task Scheduler or Ansible) may generate network connections matching the IClickFix IOCs, specifically targeting external update or telemetry endpoints during off-hours.

  • Suggested Filter: Create an exclusion based on the Process Name being a known backup service (e.g., VeeamAgent.exe, BackupExec.exe) and restrict the alert to only trigger if the source IP is not within the designated “Backup Subnet” range.

• IT Helpdesk Admin Manual Troubleshooting: During peak operational hours, IT administrators frequently launch the IClickFix client manually from their workstations to investigate user tickets or push configuration updates. This manual interaction triggers the same IOCs as a potential threat scan, particularly when admins access external knowledge base URLs defined in the rule.

  • Suggested Filter: Implement an exclusion for source IP addresses belonging to the “IT-Admin” Active Directory group or specific VLANs (e.g., 10.20.x.x), ensuring that manual administrative actions do not generate high-priority alerts.

• Automated Patch Deployment via SCCM/Intune: In environments using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the deployment of IClickFix updates often occurs during maintenance windows. The distribution points and client agents communicate with the IClickFix update servers, generating traffic that matches the detection logic for “Update Service” IOCs.

  • Suggested Filter: Exclude alerts where the Parent Process is a known deployment engine (e.g., ccmexec.exe, `Intune