ThreatFox: Kimwolf IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by identifying network and host artifacts matching ten specific Indicators of Compromise (IOCs) linked to the Kimwolf threat actor. Proactively hunting for these signals in Azure Sentinel is critical to enable early detection of potential intrusions before they escalate into broader compromises within the organization’s cloud infrastructure.

IOC Summary

Malware Family: Kimwolf Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`188[.]166[.]8[.]118:25001`	botnet_cc	2026-07-30	100%
ip:port	`159[.]223[.]4[.]28:25001`	botnet_cc	2026-07-30	100%
ip:port	`167[.]99[.]40[.]241:25001`	botnet_cc	2026-07-30	100%
ip:port	`174[.]138[.]11[.]120:25001`	botnet_cc	2026-07-30	100%
ip:port	`167[.]71[.]10[.]167:25001`	botnet_cc	2026-07-30	100%
ip:port	`134[.]122[.]48[.]153:25001`	botnet_cc	2026-07-30	100%
ip:port	`167[.]99[.]42[.]71:25001`	botnet_cc	2026-07-30	100%
ip:port	`188[.]166[.]64[.]30:25001`	botnet_cc	2026-07-30	100%
ip:port	`188[.]166[.]55[.]237:25001`	botnet_cc	2026-07-30	100%
ip:port	`146[.]190[.]17[.]104:25001`	botnet_cc	2026-07-30	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Kimwolf
let malicious_ips = dynamic(["188.166.55.237", "146.190.17.104", "167.71.10.167", "167.99.42.71", "159.223.4.28", "188.166.64.30", "167.99.40.241", "188.166.8.118", "174.138.11.120", "134.122.48.153"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.166.55.237", "146.190.17.104", "167.71.10.167", "167.99.42.71", "159.223.4.28", "188.166.64.30", "167.99.40.241", "188.166.8.118", "174.138.11.120", "134.122.48.153"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Kimwolf

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Kimwolf IOCs detection rule in an enterprise environment:

Scenario: Automated Vulnerability Scanner Traffic
- Context: Enterprise vulnerability management tools like Tenable Nessus, Qualys, or Rapid7 InsightVM frequently scan external assets and may generate network flows or DNS queries matching Kimwolf IOCs (e.g., specific C2 domains or IP ranges) during their scheduled daily scans.
- Filter/Exclusion: Create a rule exclusion based on the source process name (nessus.exe, qualyspcagent.exe) and restrict alerts to non-scan hours, or exclude traffic originating from the dedicated scanner subnet (e.g., 10.20.50.0/24).
Scenario: Scheduled Backup Agent Communication
- Context: Legacy backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik often utilize specific cloud endpoints for metadata synchronization that overlap with Kimwolf IOCs, particularly during the nightly 2:00 AM maintenance window.
- Filter/Exclusion: Exclude alerts where the source process is vbrservice.exe (Veeam) or commcell.exe (Commvault) and the destination port matches standard backup ports (e.g., TCP 443, 9703), specifically during the defined maintenance window.
Scenario: Third-Party SaaS Integration Webhooks
- Context: The organization’s ITSM platform (ServiceNow) or CRM (Salesforce) utilizes webhooks to push data to external analytics partners. If a partner service shares an IP range with Kimwolf, legitimate API calls from the sn_service.exe process will trigger the detection.
- Filter/Exclusion: