ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity by correlating network and endpoint telemetry against seven specific Indicators of Compromise (IOCs) linked to the Kuiper threat campaign. Proactive hunting for these signatures in Azure Sentinel is critical to rapidly uncover early-stage intrusions associated with this high-severity threat, enabling immediate containment before lateral movement occurs.

IOC Summary

Malware Family: Kuiper Total IOCs: 7 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`11f2b24989b0edce6ffa5113c7e61470`	payload	2026-08-08	95%
sha256_hash	`cdde719462e36f6a902e40859fab9e057acc944a02cc56c43353ab449efe6105`	payload	2026-08-08	95%
sha1_hash	`8a7cc667b001f6c5e2eb56759ca725c3a1694276`	payload	2026-08-08	95%
sha1_hash	`8a7ad515a23953f1dc2eebd140f434e7a61cda9d`	payload	2026-08-08	95%
md5_hash	`e9c8477a7011ac3fdc936f8b57ae9344`	payload	2026-08-08	95%
sha256_hash	`c5125a9712a4bece5cc1d53da1914ec5ac7ba147ab37242b03ce488bc2909137`	payload	2026-08-08	95%
md5_hash	`e964a5e37ad3c1c0478ff13ac5b32c65`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["11f2b24989b0edce6ffa5113c7e61470", "cdde719462e36f6a902e40859fab9e057acc944a02cc56c43353ab449efe6105", "8a7cc667b001f6c5e2eb56759ca725c3a1694276", "8a7ad515a23953f1dc2eebd140f434e7a61cda9d", "e9c8477a7011ac3fdc936f8b57ae9344", "c5125a9712a4bece5cc1d53da1914ec5ac7ba147ab37242b03ce488bc2909137", "e964a5e37ad3c1c0478ff13ac5b32c65"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule, tailored for a legitimate enterprise environment:

Scenario: Scheduled Antivirus Definition Updates via Cloud Repository
- Context: Enterprise endpoints (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) automatically query cloud-based threat intelligence feeds to download the latest virus definition signatures. These feeds often utilize IP ranges and domains that overlap with the Kuiper IOCs, triggering alerts when the update service connects to a shared CDN node.
- Filter/Exclusion: Create a rule exclusion based on the specific process name of the security agent (e.g., MsMpEng.exe or csfalcon.exe) and limit the scope to known update server IP ranges defined in the enterprise’s DNS whitelist.
Scenario: Admin-Driven Cloud Backup Synchronization
- Context: During nightly maintenance windows, automated backup agents (such as Veeam Agent for Windows or Rubrik) initiate synchronization jobs with cloud storage providers. If the backup solution utilizes a global content delivery network that shares infrastructure with Kuiper’s detection logic, the high-volume data transfer to specific IOCs will generate false positives.
- Filter/Exclusion: Implement a time-based filter to suppress alerts originating from backup processes between 02:00 and 05:00 local time, or exclude traffic where the destination port matches standard backup protocols (e.g., TCP 443) initiated by VeeamTransport.exe.
Scenario: Corporate SaaS Application Integration
- Context: Legitimate business applications like Salesforce, Microsoft Teams, or ServiceNow often integrate with third-party analytics and security monitoring tools. If these SaaS platforms route traffic through a proxy or API gateway that resolves to one of the 7 Kuiper IOCs (often used for telemetry or logging),