ThreatFox: Jackskid IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network and endpoint logs against specific Indicators of Compromise (IOCs) linked to the Jackskid threat actor. A proactive hunt is essential in Azure Sentinel to rapidly isolate potential Jackskid intrusions before they escalate, given the high severity associated with this campaign’s known tactics for lateral movement and data exfiltration.

IOC Summary

Malware Family: Jackskid Total IOCs: 11 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Jackskid
let malicious_domains = dynamic(["burrberry.eth", "ukranianhorseriding.eth", "24carnforth2merseyside.sol", "login.trees4sale.net", "kieron.androiddebugbridge.su", "dysphoria.androiddebugbridge.su", "telaviv.androiddebugbridge.su", "jerusalem.androiddebugbridge.su", "node.androiddebugbridge.su", "wow.androiddebugbridge.su", "m3rnbvs5d.eth"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Jackskid

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Jackskid IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Software Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM deployment engine pushes a patch or application update that includes a shared DLL or executable matching one of the Jackskid IOCs. This often occurs during nightly maintenance windows where the CcmExec.exe process spawns child processes to install updates containing known benign signatures.
  • Filter/Exclusion: Exclude alerts where the parent process is CcmExec.exe (Microsoft Configuration Manager) and the file path resides within the standard SCCM installation directory (C:\Program Files\Microsoft Configuration Manager).

• Scenario: Scheduled Antivirus Engine Update Job

  • Context: The enterprise antivirus solution (e.g., CrowdStrike Falcon or Symantec Endpoint Protection) runs a scheduled job to update its definition database. The update package contains a component file that hashes to one of the Jackskid IOCs, triggering an alert during the automated UpdateService execution.
  • Filter/Exclusion: Create a rule exclusion for processes spawned by the specific AV service (e.g., FalconSensor.exe or Symantec Antivirus Service) when the file extension is .cab, .msi, or .dll and the user context is NT SERVICE\AntivirusUpdate.

• Scenario: Third-Party Backup Agent Scanning

  • Context: A backup agent (such as Veeam Agent for Windows or Rubrik) performs a pre-scan of critical system files. The agent’s internal library includes a utility tool that matches the Jackskid IOCs, causing a hit when the agent scans the C:\Windows\System32 directory during off