ThreatFox: AnimateClipper IOCs

Hunt Hypothesis

This hunt detects adversary behavior linked to the AnimateClipper threat actor by actively searching for five specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification of this sophisticated campaign allows the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: AnimateClipper Total IOCs: 5 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AnimateClipper
let malicious_domains = dynamic(["monitor.telemetry-controlsystem.in.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AnimateClipper
let malicious_urls = dynamic(["https://lb.propertyfind.cc/", "https://monitor.telemetry-controlsystem.in.net/8645-7f5a31344b9e", "https://health.winnererasable.cc/", "https://monitor.telemetry-controlsystem.in.net/jquery.min.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AnimateClipper

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: AnimateClipper IOCs detection rule:

• Scenario: Legitimate deployment of Microsoft 365 Copilot or Teams updates via Intune.

  • Context: The AnimateClipper signature often matches file hashes associated with legitimate Microsoft update packages (specifically the Teams and Office runtime components) that utilize similar animation libraries. When Intune pushes a major update to endpoints, the detection logic flags these known-good binaries as potential IOCs.
  • Filter/Exclusion: Create an exclusion rule based on the Publisher Name (Microsoft Corporation) and File Path containing C:\Program Files\Microsoft Teams or C:\Program Files (x86)\Microsoft Office. Additionally, exclude processes spawned by msiexec.exe where the parent process is IntuneManagementExtension.exe.

• Scenario: Scheduled maintenance jobs running Adobe Creative Cloud updates.

  • Context: Enterprise environments often run scheduled nightly tasks using Adobe Creative Cloud Desktop App to update design tools (e.g., Photoshop, Illustrator). These applications utilize internal animation engines that generate file artifacts matching the AnimateClipper IOCs during the background synchronization phase.
  • Filter/Exclusion: Implement a time-based exclusion for the rule between 01:00 and 05:00 local time when the job is active. Furthermore, add an exclusion for processes with the command line containing Adobe Creative Cloud.exe or file paths under C:\Program Files\Adobe.

• Scenario: Automated browser rendering tasks in Quality Assurance (QA) environments.

  • Context: QA teams utilize automated testing frameworks like Selenium or Playwright running within Docker containers to test UI animations on internal web portals. These tests often instantiate temporary