ThreatFox: Kimwolf IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring for known indicators of compromise (IOCs) linked to the Kimwolf threat actor, which often targets enterprise environments with advanced persistent threats. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage intrusions and mitigate potential data exfiltration or lateral movement before they escalate into critical incidents.

IOC Summary

Malware Family: Kimwolf Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`64[.]227[.]68[.]158:25001`	botnet_cc	2026-08-10	100%
ip:port	`165[.]22[.]197[.]20:25001`	botnet_cc	2026-08-10	100%
ip:port	`165[.]232[.]87[.]245:25001`	botnet_cc	2026-08-10	100%
ip:port	`178[.]62[.]229[.]223:25001`	botnet_cc	2026-08-10	100%
ip:port	`159[.]223[.]209[.]14:25001`	botnet_cc	2026-08-10	100%
ip:port	`161[.]35[.]155[.]251:25001`	botnet_cc	2026-08-10	100%
ip:port	`167[.]71[.]67[.]197:25001`	botnet_cc	2026-08-10	100%
ip:port	`178[.]62[.]230[.]102:25001`	botnet_cc	2026-08-10	100%
ip:port	`142[.]93[.]139[.]221:25001`	botnet_cc	2026-08-10	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Kimwolf
let malicious_ips = dynamic(["178.62.230.102", "178.62.229.223", "161.35.155.251", "64.227.68.158", "142.93.139.221", "167.71.67.197", "159.223.209.14", "165.22.197.20", "165.232.87.245"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.62.230.102", "178.62.229.223", "161.35.155.251", "64.227.68.158", "142.93.139.221", "167.71.67.197", "159.223.209.14", "165.22.197.20", "165.232.87.245"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Kimwolf

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Kimwolf IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Endpoint Protection Scans of Legacy Archives
- Scenario: Scheduled daily scans by Microsoft Defender Antivirus or CrowdStrike Falcon on a shared network drive containing legacy project archives (e.g., \\FileServer\Projects\2018_Archive) may trigger the rule if the scan engine extracts and hashes files that match Kimwolf’s known IOCs within old PDFs or compressed documents.
- Filter/Exclusion: Create a detection exclusion for file paths matching \\FileServer\Projects\* where the process name is MsMpEng.exe (Defender) or CnsNotify.exe (CrowdStrike), and restrict the alert to only trigger if the file extension is .exe, .dll, or .ps1.
Software Deployment via Configuration Management
- Scenario: An automated deployment job using Microsoft System Center Configuration Manager (SCCM) or Ansible Tower pushes a patch package containing a utility tool that shares a hash with one of the Kimwolf IOCs. The installation process generates network traffic and file writes that mimic the behavior of the malware.
- Filter/Exclusion: Exclude alerts where the initiating process is ccmsetup.exe (SCCM) or ansible-runner, specifically when the destination path is under C:\Windows\CCM\Logs or C:\ProgramData\Ansible. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).
Third-Party Backup Agent Operations
- Scenario: The enterprise uses Veeam Backup & Replication or Rubrik,