← Back to SOC feed Coverage →

ThreatFox: Kuiper IOCs

ioc-hunt HIGH ThreatFox
DeviceFileEvents
elf-kuiperiocthreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-31T23:00:00Z · Confidence: high

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network traffic and endpoint logs against a curated set of eighteen Indicators of Compromise (IOCs) specific to the ThreatFox Kuiper threat intelligence feed. Proactively hunting for these IOCs in Azure Sentinel is critical because it enables the SOC team to rapidly detect early-stage intrusions from known malicious infrastructure, reducing dwell time before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Kuiper Total IOCs: 18 IOC Types: sha1_hash, md5_hash, sha256_hash

TypeValueThreat TypeFirst SeenConfidence
sha1_hasha9a0ff21db03e1cb900b0f69c078932a98ddcaf7payload2026-07-3195%
md5_hashde225ab0dac2c90346c919c55e5e5bf5payload2026-07-3195%
sha256_hash10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64cepayload2026-07-3195%
sha256_hash245f0ee939fa4068c7ac66b51a51f845e1cc8070ee76e21aedf57be7b087ef9cpayload2026-07-3195%
sha1_hash14eb15d49e8ebd6c6dad52e1ec80b44ae49c0e0apayload2026-07-3195%
md5_hashb60a0a174d96173628384a06b96654depayload2026-07-3195%
sha1_hashd56030b16c703001cf6525387afe3afe8d4067c3payload2026-07-3195%
md5_hash29e642bacb450b90b4d54e26ec5fb5d7payload2026-07-3195%
sha256_hash4c3084e6f337e867f335f4b04937350f150e82888f391ca63427f8eafa76c978payload2026-07-3195%
md5_hashdd79f535f6108df5bea9c3b2be064a09payload2026-07-3195%
sha1_hashad55499168f6028869bb7ebdd83406b948ede9f1payload2026-07-3195%
sha256_hash5f1146ec4c1130cd64af934de2687d6dc78330b3bc6c8486deb39b9305b10d72payload2026-07-3195%
sha256_hashb8e46b0ece6c02f2b6069a9cbe9686ce595d7ca59494214cc6d6ebaa9b5d072apayload2026-07-3195%
sha1_hash7d4bbf2b3d993c1d50730c65e2e05ccf697aff7cpayload2026-07-3195%
md5_hash4be121d6585848c9bd316f1aad94e383payload2026-07-3195%
md5_hashbaff942fdabd6c068b3e941dd29fddadpayload2026-07-3195%
sha256_hash3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3payload2026-07-3195%
sha1_hash4081a567b593f51ca6c8d98902311e872513ccd6payload2026-07-3195%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["a9a0ff21db03e1cb900b0f69c078932a98ddcaf7", "de225ab0dac2c90346c919c55e5e5bf5", "10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64ce", "245f0ee939fa4068c7ac66b51a51f845e1cc8070ee76e21aedf57be7b087ef9c", "14eb15d49e8ebd6c6dad52e1ec80b44ae49c0e0a", "b60a0a174d96173628384a06b96654de", "d56030b16c703001cf6525387afe3afe8d4067c3", "29e642bacb450b90b4d54e26ec5fb5d7", "4c3084e6f337e867f335f4b04937350f150e82888f391ca63427f8eafa76c978", "dd79f535f6108df5bea9c3b2be064a09", "ad55499168f6028869bb7ebdd83406b948ede9f1", "5f1146ec4c1130cd64af934de2687d6dc78330b3bc6c8486deb39b9305b10d72", "b8e46b0ece6c02f2b6069a9cbe9686ce595d7ca59494214cc6d6ebaa9b5d072a", "7d4bbf2b3d993c1d50730c65e2e05ccf697aff7c", "4be121d6585848c9bd316f1aad94e383", "baff942fdabd6c068b3e941dd29fddad", "3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3", "4081a567b593f51ca6c8d98902311e872513ccd6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding filters for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/elf.kuiper/