ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis detects adversary activity by correlating network and endpoint telemetry against eleven specific Indicators of Compromise (IOCs) linked to the Kuiper threat cluster. Proactively hunting for these IOCs within Azure Sentinel is critical because early identification of known malicious artifacts enables rapid containment before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Kuiper Total IOCs: 11 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`0664d2922ea22920f609f17e3f5b512623d940b5`	payload	2026-07-30	95%
md5_hash	`af38775c7c7dc7046f77a7748b89933d`	payload	2026-07-30	95%
sha256_hash	`27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093`	payload	2026-07-30	95%
sha1_hash	`58ab34482258c4b7f1c8e1f7e5b71d93060117a0`	payload	2026-07-30	95%
md5_hash	`63951c4114bb7b172c40a8d72f1571eb`	payload	2026-07-30	95%
sha256_hash	`e0968fdd46a966fd96963e0c082c826f0f4f68c6ae7c47db740e375b838a5166`	payload	2026-07-30	95%
md5_hash	`fb52e944c7d2c7ef88c1fa2bc49bca8d`	payload	2026-07-30	95%
sha256_hash	`a698fd443f31acb8747f8f8a33460eb04952bf3437ff0e07236207acace850e8`	payload	2026-07-30	95%
sha1_hash	`2cbd1b25814007055d72bb2373ae5d3a15f6f891`	payload	2026-07-30	95%
sha1_hash	`69959abe409438a3f0a7b5a48c6ee0eba89e52f2`	payload	2026-07-30	95%
md5_hash	`7e156047d9217122c15da13f2c8765a5`	payload	2026-07-30	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["0664d2922ea22920f609f17e3f5b512623d940b5", "af38775c7c7dc7046f77a7748b89933d", "27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093", "58ab34482258c4b7f1c8e1f7e5b71d93060117a0", "63951c4114bb7b172c40a8d72f1571eb", "e0968fdd46a966fd96963e0c082c826f0f4f68c6ae7c47db740e375b838a5166", "fb52e944c7d2c7ef88c1fa2bc49bca8d", "a698fd443f31acb8747f8f8a33460eb04952bf3437ff0e07236207acace850e8", "2cbd1b25814007055d72bb2373ae5d3a15f6f891", "69959abe409438a3f0a7b5a48c6ee0eba89e52f2", "7e156047d9217122c15da13f2c8765a5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

Scenario: Scheduled Vulnerability Scanning by Enterprise Tools
- Context: Security operations centers often run scheduled vulnerability scans (e.g., using Tenable Nessus, Qualys, or Microsoft Defender for Endpoint) that probe external threat intelligence feeds. If the Kuiper IOCs include IP addresses or domains used by these vendors’ update servers, the scanner’s outbound traffic will trigger the rule during its nightly cycle.
- Filter/Exclusion: Create a filter to exclude alerts where the source process is Tenable.Nessus.exe, qualysPCAgent.exe, or MsMpEng.exe (Microsoft Defender) and the event time falls within the defined maintenance window (e.g., 02:00–04:00 UTC).
Scenario: Cloud Backup and Synchronization Services
- Context: Enterprise data backup solutions like Veeam, Rubrik, or Microsoft Azure Backup frequently communicate with cloud storage endpoints. If the Kuiper IOCs contain IP ranges associated with these cloud providers (e.g., AWS, Azure, or specific SaaS backup nodes), legitimate backup jobs running during business hours will generate high-volume false positives.
- Filter/Exclusion: Exclude alerts where the destination port is 443 and the process name matches known backup agents (Veeam.Backup.Service.exe, rubrik-agent.exe) communicating with whitelisted cloud IP ranges identified in the organization’s network topology map.
Scenario: Automated Patch Management Deployments
- Context: During major patch cycles, tools like WSUS (Windows Server Update Services), SCCM, or Patch My PC download