ThreatFox: Kuiper IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary activity involving known indicators of compromise (IOCs) from the ThreatFox Kuiper threat intelligence feed to identify potential early-stage intrusions or compromised assets within the Azure Sentinel environment. Proactively hunting for these specific IOCs allows the SOC team to rapidly detect and respond to emerging threats before they escalate, leveraging high-fidelity external intelligence to reduce dwell time on critical security incidents.

IOC Summary

Malware Family: Kuiper Total IOCs: 21 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	6afcaa8ef95e2867087f41d30b3e3e1b	payload	2026-07-27	95%
md5_hash	fe1f23de8bd1e84ad1a33939638144ee	payload	2026-07-27	95%
sha256_hash	55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d	payload	2026-07-27	95%
sha1_hash	29a21b6970cf47fe514bdff500d8b1d326420024	payload	2026-07-27	95%
sha256_hash	6342bad7408a482326ff663f94f092e5c8e7757f83a6b4a3c39b80e113338c0f	payload	2026-07-27	95%
sha1_hash	ed62786497220ef110a774aebe24e400f0ed8517	payload	2026-07-27	95%
md5_hash	8a5bc9290195e29bfc9214ffa8e13126	payload	2026-07-27	95%
sha256_hash	68891e60955a121e092f5b987100b85f2f3c75af0a7636161dbab9ca2ec04848	payload	2026-07-27	95%
sha1_hash	aca464ae81f26c415a65fadd91cceea55716d617	payload	2026-07-27	95%
sha256_hash	6f23c7805963d98f57ba6497f17168967545e203774f383b23807f0dcb86e0d0	payload	2026-07-27	95%
sha1_hash	8057152364fdbcbd18811eb09baabae1a32b2db5	payload	2026-07-27	95%
md5_hash	7696f9286237810feb2fcdce7eb6b953	payload	2026-07-27	95%
sha1_hash	725267275ae18ea5f45798957c100eb3136edda6	payload	2026-07-27	95%
md5_hash	d71b2f14528e27c87ecf8b786c252d57	payload	2026-07-27	95%
sha256_hash	a006492687681003d32393ccdd5b050340342672a29698d3cc399e4e2471bcf5	payload	2026-07-27	95%
md5_hash	b909d08eaab5ebd97e5ee9af79d9952a	payload	2026-07-27	95%
sha256_hash	e15b78ffb8b880b99ea1dbc2f51d1426fa0d72da39c10e5a0e364d62ccfaa1ce	payload	2026-07-27	95%
sha1_hash	e03a3925deefb4888331a3c9573a5199248ac9f5	payload	2026-07-27	95%
sha1_hash	f5f2634f60b18f0eddb9edd155f89329d85315a1	payload	2026-07-27	95%
md5_hash	80bd4cf388f4109cbf2ec1433a1813aa	payload	2026-07-27	95%
sha256_hash	50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["6afcaa8ef95e2867087f41d30b3e3e1b", "fe1f23de8bd1e84ad1a33939638144ee", "55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d", "29a21b6970cf47fe514bdff500d8b1d326420024", "6342bad7408a482326ff663f94f092e5c8e7757f83a6b4a3c39b80e113338c0f", "ed62786497220ef110a774aebe24e400f0ed8517", "8a5bc9290195e29bfc9214ffa8e13126", "68891e60955a121e092f5b987100b85f2f3c75af0a7636161dbab9ca2ec04848", "aca464ae81f26c415a65fadd91cceea55716d617", "6f23c7805963d98f57ba6497f17168967545e203774f383b23807f0dcb86e0d0", "8057152364fdbcbd18811eb09baabae1a32b2db5", "7696f9286237810feb2fcdce7eb6b953", "725267275ae18ea5f45798957c100eb3136edda6", "d71b2f14528e27c87ecf8b786c252d57", "a006492687681003d32393ccdd5b050340342672a29698d3cc399e4e2471bcf5", "b909d08eaab5ebd97e5ee9af79d9952a", "e15b78ffb8b880b99ea1dbc2f51d1426fa0d72da39c10e5a0e364d62ccfaa1ce", "e03a3925deefb4888331a3c9573a5199248ac9f5", "f5f2634f60b18f0eddb9edd155f89329d85315a1", "80bd4cf388f4109cbf2ec1433a1813aa", "50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Kuiper

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule, along with targeted filtering strategies:

• Scenario: Automated Vulnerability Scanning by Enterprise Security Tools

  • Context: Internal vulnerability management platforms (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically query external threat intelligence feeds to update their local databases. These scanners often initiate outbound connections to the Kuiper feed servers, matching the rule’s IOCs while performing routine updates rather than indicating a compromise.
  • Suggested Filter: Create an exclusion based on the source host group or specific service accounts.
    • Filter: Source_Host_Group IN ("Vulnerability_Scan_Nodes") AND Process_Name IN ("nessus.exe", "qualyspcd.exe", "insightvm-agent.exe")

• Scenario: Scheduled Threat Intelligence Feed Synchronization

  • Context: The organization’s SIEM or EDR solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) runs a scheduled job every morning at 02:00 AM to pull the latest IOCs from the Kuiper feed. This recurring administrative task triggers the detection logic as it establishes connections to the specific IP addresses and domains defined in the rule.
  • Suggested Filter: Exclude events occurring during known maintenance windows or originating from the SIEM’s dedicated ingestion service account.
    • Filter: (Event_Time BETWEEN "01:30" AND "02:45") AND Source_User_Name = "svc-threat-intel-sync"

• Scenario: Cloud Backup and Replication Services

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik may utilize the Kuiper IOCs to validate the security posture of cloud