ThreatFox: Hook IOCs

Hunt Hypothesis

This hypothesis targets the Hook malware family, which establishes covert command-and-control channels and exfiltrates data through compromised IP:port pairs often disguised as legitimate traffic. Proactively hunting for these specific IOCs in Azure Sentinel is critical to identify early-stage compromise and prevent lateral movement before the adversary achieves full persistence or data exfiltration.

IOC Summary

Malware Family: Hook Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Hook
let malicious_ips = dynamic(["130.61.146.214"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["130.61.146.214"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Hook

False Positive Guidance

• Legacy Application Health Checks: Older enterprise applications (e.g., custom Java or .NET services) may use hardcoded, non-standard IP:port pairs for internal health checks or heartbeat signals to a monitoring agent. If these endpoints match the Hook IOCs, they will trigger alerts.
  • Filter/Exclusion: Exclude outbound connections from specific service accounts (e.g., svc_app_monitor) or source IPs belonging to the application server VLAN to the known Hook C2 IPs, provided the destination port matches the application’s expected health check port (e.g., 8080 or 9000) rather than a standard web port.
• Third-Party SaaS Backup Agents: Enterprise backup solutions like Veeam, Commvault, or Acronis often establish persistent outbound connections to their cloud management planes or local gateways using specific IP:port combinations. If a backup agent’s communication endpoint coincides with a Hook IOC, it creates a false positive.
  • Filter/Exclusion: Create a network segment exclusion for the Backup VLAN or exclude specific process names (e.g., veeam.exe, cvp.exe) when connecting to the Hook IOC IPs, assuming the connection is initiated by the backup service account and not a user session.
• Internal DNS or DHCP Relay Servers: In complex network architectures, internal DNS or DHCP relay services may use specific IP:port pairs for replication or synchronization. If these internal infrastructure IPs are mistakenly listed in the Hook IOC set (or if the malware uses a common port like 53 or 67 that overlaps with legitimate services), alerts may fire.
  • Filter/Exclusion: Exclude traffic where the source is a known infrastructure server (e.g., 10.0.1.50 for DNS) and the destination port is 53 (DNS) or 67/68 (DHCP),