This detection rule identifies adversary activity by correlating network traffic and endpoint logs against a curated set of 18 Indicators of Compromise (IOCs) linked to the Kuiper threat campaign. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly detect early-stage intrusions from this known threat actor, enabling the SOC team to isolate affected assets before lateral movement or data exfiltration occurs.
Malware Family: Kuiper Total IOCs: 18 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | 18b3741afc2712dafb56505b1c1822372b35cc0b | payload | 2026-07-24 | 95% |
| md5_hash | a20052c78501ce91feba8ce56a3aa665 | payload | 2026-07-24 | 95% |
| sha256_hash | 366e52b6d95d9478a73ffcd659a1807bdea901a0737b7b2532fe11145be03925 | payload | 2026-07-24 | 95% |
| sha256_hash | 56091719eeba4881f3db1f837feaa9d47a5a275bff6218186d97614e252e6d21 | payload | 2026-07-24 | 95% |
| sha1_hash | 432375fba1147d8880a98b149fe7f8f2e4f78d1a | payload | 2026-07-24 | 95% |
| md5_hash | 9f3955f8be35326246e2551754bd6d5e | payload | 2026-07-24 | 95% |
| sha256_hash | e3fd70ee3f7e5da3d77af2bde5e7eddbc6a9df6b3e8df62aafbd28fdcd65bd27 | payload | 2026-07-24 | 95% |
| sha1_hash | 7eef6fae32a9d83cd1950cd0b287e3657360bcc6 | payload | 2026-07-24 | 95% |
| md5_hash | 4202ea3b73d6d50177e93c2dc10ebee0 | payload | 2026-07-24 | 95% |
| sha1_hash | d92b5cc0d77fc3a739ccfdcca04a0d533b21fc25 | payload | 2026-07-24 | 95% |
| md5_hash | 0a2054469724717c2577c145907e3501 | payload | 2026-07-24 | 95% |
| sha256_hash | 879daa96ac18a98fe5d8c650f71aad182776f96d00209eabcd05450833c8cfa7 | payload | 2026-07-24 | 95% |
| sha256_hash | 578d6beea6123baf73ce30fd1cb245fac0225fcd2199754e12597550ffafd40a | payload | 2026-07-24 | 95% |
| sha1_hash | 2386b4fd541b9dc701d01fad5d50d92b426532c5 | payload | 2026-07-24 | 95% |
| md5_hash | c9c763b2affed693071ced6d9c074af3 | payload | 2026-07-24 | 95% |
| md5_hash | 00cd35c4f8afda228da86503adcc2be3 | payload | 2026-07-24 | 95% |
| sha256_hash | eddcc00fbbaa2823bdfc0ce09f0c4d1f13de9ced5d54deaeda103739a67d0881 | payload | 2026-07-24 | 95% |
| sha1_hash | d48772f91907385039c4ff26e89766680d273b8f | payload | 2026-07-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["18b3741afc2712dafb56505b1c1822372b35cc0b", "a20052c78501ce91feba8ce56a3aa665", "366e52b6d95d9478a73ffcd659a1807bdea901a0737b7b2532fe11145be03925", "56091719eeba4881f3db1f837feaa9d47a5a275bff6218186d97614e252e6d21", "432375fba1147d8880a98b149fe7f8f2e4f78d1a", "9f3955f8be35326246e2551754bd6d5e", "e3fd70ee3f7e5da3d77af2bde5e7eddbc6a9df6b3e8df62aafbd28fdcd65bd27", "7eef6fae32a9d83cd1950cd0b287e3657360bcc6", "4202ea3b73d6d50177e93c2dc10ebee0", "d92b5cc0d77fc3a739ccfdcca04a0d533b21fc25", "0a2054469724717c2577c145907e3501", "879daa96ac18a98fe5d8c650f71aad182776f96d00209eabcd05450833c8cfa7", "578d6beea6123baf73ce30fd1cb245fac0225fcd2199754e12597550ffafd40a", "2386b4fd541b9dc701d01fad5d50d92b426532c5", "c9c763b2affed693071ced6d9c074af3", "00cd35c4f8afda228da86503adcc2be3", "eddcc00fbbaa2823bdfc0ce09f0c4d1f13de9ced5d54deaeda103739a67d0881", "d48772f91907385039c4ff26e89766680d273b8f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment:
Enterprise Endpoint Protection Scans: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs scheduled daily definition updates that download hash signatures matching the Kuiper IOC list.
Process Name matches known security agents (e.g., FalconSensor.exe, MsMpEng.exe) and the User Account is a local system or service account (e.g., NT AUTHORITY\SYSTEM).Automated Patch Management Deployments: The IT operations team utilizes a tool like SCCM (System Center Configuration Manager) or Jamf to push security patches across the fleet, which triggers network connections to Kuiper-managed update repositories.
Destination Port is standard HTTPS (443) or WSUS ports (8531).Third-Party SIEM/Threat Intel Ingestion: The enterprise Security Information and Event Management (SIEM) platform (e.g., Splunk or Sentinel) runs a scheduled job to ingest threat intelligence feeds from ThreatFox, generating internal queries that match the Kuiper IOCs.
Source Host is identified as the SIEM collector node and the Process Command Line contains keywords related to feed ingestion (e.g., “threat-intel-sync”, “feed-updater”).Cloud Storage Synchronization Jobs: Business users utilize OneDrive for Business or SharePoint Online, which may route synchronization traffic through a proxy that resolves to Ku