ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network traffic and endpoint logs against nine specific Indicators of Compromise (IOCs) linked to the Kuiper threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this high-severity campaign allows the SOC team to contain potential lateral movement and data exfiltration before they escalate into a broader breach.

IOC Summary

Malware Family: Kuiper Total IOCs: 9 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`12767208e2775d74cec36dfe0a6dadf4`	payload	2026-08-04	95%
sha256_hash	`f1f304a6be3928d7c8ee7e65e23b4306da4d83c5ff0bb3791ef44afe2506e2f2`	payload	2026-08-04	95%
sha1_hash	`9ce079710d5d0e0d8778b6fd5eaae8267bb9dc04`	payload	2026-08-04	95%
sha1_hash	`90734748b072f42f9f89ba03057a6f9ab4bed72f`	payload	2026-08-04	95%
md5_hash	`f0d2934199c9f86d25014d628cd7385a`	payload	2026-08-04	95%
sha256_hash	`b2b6c906f355c11945f84134f27559acce2247ae2214d544734bddf97e9ee22c`	payload	2026-08-04	95%
sha1_hash	`b8afef7e77d61a2abf0b80915cc0769f2c0531ae`	payload	2026-08-04	95%
md5_hash	`df84f03c4fa8d429a13e4ce8b010a66a`	payload	2026-08-04	95%
sha256_hash	`98c3283cac92544cf7d2237d4a457181ae5a2e3983bb17728df8b81d067c8e4a`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["12767208e2775d74cec36dfe0a6dadf4", "f1f304a6be3928d7c8ee7e65e23b4306da4d83c5ff0bb3791ef44afe2506e2f2", "9ce079710d5d0e0d8778b6fd5eaae8267bb9dc04", "90734748b072f42f9f89ba03057a6f9ab4bed72f", "f0d2934199c9f86d25014d628cd7385a", "b2b6c906f355c11945f84134f27559acce2247ae2214d544734bddf97e9ee22c", "b8afef7e77d61a2abf0b80915cc0769f2c0531ae", "df84f03c4fa8d429a13e4ce8b010a66a", "98c3283cac92544cf7d2237d4a457181ae5a2e3983bb17728df8b81d067c8e4a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule, including suggested filters or exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus Definitions Update via Cloud Repository
- Context: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon are configured to pull definition updates from a cloud repository that shares the same IP range or domain as the Kuiper IOCs. The scheduled update job (e.g., DefenderUpdate.exe running via Task Scheduler) connects to these IOCs daily, triggering the alert.
- Suggested Filter: Exclude network traffic where the source process is a known security agent (e.g., MsMpEng.exe, FalconSensorService) and the destination port matches standard update ports (443/80), specifically during business hours or defined maintenance windows.
Scenario: Automated Patch Management Deployment
- Context: The organization utilizes Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons to push OS and application patches. These tools often utilize the Kuiper IOCs as part of their content delivery network (CDN) to download patch manifests. When a global deployment job runs, thousands of endpoints simultaneously hit these IOCs, generating high-volume alerts.
- Suggested Filter: Create an exclusion rule based on the source process name (ccmsetup.exe, IvantiAgent.exe) and correlate with the “Patch Deployment” event ID in the SIEM to suppress alerts occurring within 1 hour of a scheduled patch window.
Scenario: Enterprise Cloud Backup Synchronization
- Context: Legacy or hybrid backup solutions like Veeam Backup & Replication or Rubrik use cloud gateways that route traffic through nodes associated with the Kuiper IOCs to