ThreatFox: GCleaner IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving known Indicators of Compromise (IOCs) linked to the GCleaner malware family, which often targets endpoints to establish persistence and exfiltrate sensitive data. A SOC team should proactively hunt for these IOCs within Azure Sentinel to identify early-stage infections that may evade standard signature-based detection, thereby preventing potential lateral movement and data breaches before they escalate.

IOC Summary

Malware Family: GCleaner Total IOCs: 6 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - GCleaner
let malicious_urls = dynamic(["http://91.92.242.236/success?substr=mixfive&s=three&sub=nn", "http://91.92.242.236/dll", "http://91.92.242.236/info", "http://91.92.242.236/update", "http://91.92.242.236/service", "http://91.92.242.236/ycl"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — GCleaner

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: GCleaner IOCs detection rule:

• Endpoint Protection Maintenance Jobs

  • Scenario: Enterprise Endpoint Detection and Response (EDR) platforms, such as CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint, often schedule automated “cleanup” tasks that utilize the GCleaner utility to remove temporary files, orphaned logs, and obsolete quarantine artifacts. These jobs run nightly via Windows Task Scheduler under a dedicated service account (e.g., svc-edr-maint), triggering the detection of GCleaner IOCs during off-hours.
  • Suggested Filter/Exclusion: Create an exclusion rule that ignores alerts generated by process trees rooted in known EDR services or specific scheduled tasks. For example, exclude events where the parent process is falcon.sys, cb.exe, or MsMpEng.exe, and the execution time falls within a defined maintenance window (e.g., 02:00–04:00 UTC).

• IT Asset Management & Patch Deployment

  • Scenario: During large-scale patch deployment cycles using tools like Ivanti Neurons, ManageEngine Desktop Central, or SCCM (Configuration Manager), the GCleaner tool is frequently invoked as a post-installation step to clear installation caches and temporary folders on thousands of endpoints simultaneously. This mass execution generates a high volume of IOCs that mimic malicious behavior but are part of standard change management procedures.
  • Suggested Filter/Exclusion: Implement an exclusion based on the “Change Request ID” or specific deployment job names. If the detection logic can correlate with ITSM tickets, exclude alerts where the process command line contains a known patching identifier (e.g., --job-id=PATCH-WIN10-Q3) or originates from a specific management