ThreatFox: Clipper IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Clipper malware by monitoring for six specific indicators of compromise that signal potential banking trojan infections within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel because early identification of Clipper’s presence is critical to preventing financial fraud and unauthorized transaction manipulation before attackers can execute their payload.

IOC Summary

Malware Family: Clipper Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c`	payload	2026-08-02	95%
sha1_hash	`cb5be7c6c404339029a88a7a4ffc0465da77288a`	payload	2026-08-02	95%
md5_hash	`5c8e68a414254a67111c6167f44ec777`	payload	2026-08-02	95%
md5_hash	`bf50325f1dbd215e1c734c00b251789d`	payload	2026-08-02	95%
sha256_hash	`bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40`	payload	2026-08-02	95%
sha1_hash	`4b988defc8a7a8d8b86ef2d79ff1cdd6b31b7d34`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Clipper
let malicious_hashes = dynamic(["350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c", "cb5be7c6c404339029a88a7a4ffc0465da77288a", "5c8e68a414254a67111c6167f44ec777", "bf50325f1dbd215e1c734c00b251789d", "bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40", "4b988defc8a7a8d8b86ef2d79ff1cdd6b31b7d34"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Clipper

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Clipper IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise endpoints running Microsoft Defender ATP (MDATP) or CrowdStrike Falcon often trigger the specific file hashes associated with Clipper when performing nightly definition updates. The update process creates temporary files in the C:\ProgramData\Microsoft\Windows Defender\Updates directory that match the IOCs monitored by this rule.
- Filter/Exclusion: Add a filter to exclude alerts where the process name is MsMpEng.exe (for Microsoft) or csfalcon.exe (for CrowdStrike) AND the file path contains \Windows Defender\Updates\. Alternatively, create an exclusion for the specific IOCs if they are consistently generated by these AV update processes during maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Automated Backup and Archiving Jobs
- Context: Legacy backup solutions like Veeam Backup & Replication or Commvault often utilize compression algorithms that generate temporary archive files. If the Clipper IOCs include specific file signatures (e.g., .zip or custom container formats) used by these agents, the rule may trigger when a scheduled job compresses large datasets on file servers.
- Filter/Exclusion: Exclude alerts where the parent process is VeeamService.exe, vbrservice.exe, or commvault_agent.exe. Additionally, filter out events occurring on known backup server hostnames (e.g., SRV-BACKUP-01) to prevent noise from high-volume data movement tasks.
Scenario: Deployment of Internal Security Tools
- Context: