ThreatFox: vo1d IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific indicators of compromise (IOCs) linked to the “vo1d” threat actor, signaling potential reconnaissance or initial access attempts within the network. A proactive hunt in Azure Sentinel is essential to rapidly validate these high-severity signals and determine if they represent a broader campaign that requires immediate containment before lateral movement occurs.

IOC Summary

Malware Family: vo1d Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - vo1d
let malicious_ips = dynamic(["38.97.63.243", "38.97.63.242"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.97.63.243", "38.97.63.242"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — vo1d

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: vo1d IOCs detection rule in an enterprise environment:

• Endpoint Protection Policy Updates via Scheduled Tasks

  • Scenario: The organization uses a centralized Endpoint Detection and Response (EDR) solution like CrowdStrike Falcon or Microsoft Defender for Endpoint. A nightly scheduled task runs to update threat intelligence feeds, which includes downloading the latest IOCs from ThreatFox. This process often triggers network connections to vo1d domains/URLs that are part of the vendor’s standard update mechanism but lack specific whitelisting in the detection logic.
  • Suggested Filter: Create an exclusion rule based on the Process Name (FalconSensor.exe or MsMpEng.exe) and the Parent Process (e.g., TaskScheduler.exe). If the initiating process is a known EDR agent running under the SYSTEM account, suppress the alert.

• IT Administration: Cloud Backup and Archiving Jobs

  • Scenario: The IT operations team utilizes Veeam Backup & Replication or Rubrik for daily data archiving. These tools often integrate with external threat intelligence APIs to tag backup metadata with current security IOCs. During the “Pre-Backup” phase, the backup service initiates a query against ThreatFox’s vo1d endpoints to validate file integrity signatures before commencing the transfer.
  • Suggested Filter: Exclude alerts where the source IP belongs to the Backup Server Subnet (e.g., 10.20.50.x) and the destination port is restricted to standard API ports (443 or 8443). Additionally, filter by the specific service account name used for backups (e.g., svc-veeam-backup).

• **DevOps Pipeline: CI/