ThreatFox: Kuiper IOCs

Hunt Hypothesis

This rule detects adversary activity by matching network and endpoint telemetry against 24 specific Indicators of Compromise (IOCs) linked to the Kuiper threat cluster. Proactive hunting for these IOCs within Azure Sentinel is critical because their high severity suggests an active campaign that may evade standard signature-based defenses, requiring immediate investigation to prevent potential lateral movement or data exfiltration.

IOC Summary

Malware Family: Kuiper Total IOCs: 24 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	8bc62193a60f3d63e0e56d4564d08a12fae7036b	payload	2026-07-25	95%
md5_hash	c5d14331d0910a8d4d724b3c00329ced	payload	2026-07-25	95%
md5_hash	844316e11edc801dcad57532a47d45e0	payload	2026-07-25	95%
sha256_hash	81775ecf00ef60ef088c4d79d37ad60154dcc43bc8edce4ec56bb509331feaa8	payload	2026-07-25	95%
sha1_hash	5dec3afbd81e113a798be61868d1a4835c3ecb6c	payload	2026-07-25	95%
sha256_hash	4132a264cf4d25b6b9104fb6332f9a082e354abf96486c34a07cf5e32277dfd3	payload	2026-07-25	95%
sha256_hash	d615bb89afdae1f96c6f60522ddd87e9de781a0826a9070f822c1f344bc86cce	payload	2026-07-25	95%
sha1_hash	4d989e8a514dc79e4622114d0bb40f9dd90d4f3c	payload	2026-07-25	95%
md5_hash	5dae1853a24173ae60859c7ce246ff3d	payload	2026-07-25	95%
sha256_hash	a414b6ef203d4320665d72cf43e98fefbd451123a2c7f10a56728a2cc207ced7	payload	2026-07-25	95%
sha1_hash	4075db854bef2e4a9b402515859bbad9477d53ac	payload	2026-07-25	95%
md5_hash	e691d9c99d46ee5ef886a9e276d8def9	payload	2026-07-25	95%
md5_hash	8c2b56e131814f9db398deb1de15e67e	payload	2026-07-25	95%
sha256_hash	70b84b94aa20a52bbb225f76fcb9b7a66c1733ff6665f13fedb5e93645205a9e	payload	2026-07-25	95%
sha1_hash	3e5ffafb3f176acc56c78e80252bf604a8bd9b2d	payload	2026-07-25	95%
sha1_hash	382691f2d43661110ad9f015d55427f446719ec0	payload	2026-07-25	95%
md5_hash	2f03381aa105015dc380dbf4e4d0e627	payload	2026-07-25	95%
sha256_hash	3e5d5288ddfe5d8ad18232a0eb36a4f0d52660c3978b33bc5e9563a217a282c6	payload	2026-07-25	95%
sha256_hash	e73c81b0befddfe58f2472dd3a2468d102caacc7cd71a7793b732efa3fdd05d1	payload	2026-07-25	95%
sha1_hash	9d0462015be177d700801a1316b8d983d80a4b2c	payload	2026-07-25	95%
md5_hash	78e88d6e7810b936cb1091a196685dcc	payload	2026-07-25	95%
sha256_hash	fdb081750d0ce60ab67f4280a7d690a188b47643eae2a26cdff52010c5a6acf8	payload	2026-07-25	95%
sha1_hash	c7247cb9a15ce08bfb22e43c65cfe6c90c3c7493	payload	2026-07-25	95%
md5_hash	e36370f93cda87df77dddbe1a00a8dcc	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["8bc62193a60f3d63e0e56d4564d08a12fae7036b", "c5d14331d0910a8d4d724b3c00329ced", "844316e11edc801dcad57532a47d45e0", "81775ecf00ef60ef088c4d79d37ad60154dcc43bc8edce4ec56bb509331feaa8", "5dec3afbd81e113a798be61868d1a4835c3ecb6c", "4132a264cf4d25b6b9104fb6332f9a082e354abf96486c34a07cf5e32277dfd3", "d615bb89afdae1f96c6f60522ddd87e9de781a0826a9070f822c1f344bc86cce", "4d989e8a514dc79e4622114d0bb40f9dd90d4f3c", "5dae1853a24173ae60859c7ce246ff3d", "a414b6ef203d4320665d72cf43e98fefbd451123a2c7f10a56728a2cc207ced7", "4075db854bef2e4a9b402515859bbad9477d53ac", "e691d9c99d46ee5ef886a9e276d8def9", "8c2b56e131814f9db398deb1de15e67e", "70b84b94aa20a52bbb225f76fcb9b7a66c1733ff6665f13fedb5e93645205a9e", "3e5ffafb3f176acc56c78e80252bf604a8bd9b2d", "382691f2d43661110ad9f015d55427f446719ec0", "2f03381aa105015dc380dbf4e4d0e627", "3e5d5288ddfe5d8ad18232a0eb36a4f0d52660c3978b33bc5e9563a217a282c6", "e73c81b0befddfe58f2472dd3a2468d102caacc7cd71a7793b732efa3fdd05d1", "9d0462015be177d700801a1316b8d983d80a4b2c", "78e88d6e7810b936cb1091a196685dcc", "fdb081750d0ce60ab67f4280a7d690a188b47643eae2a26cdff52010c5a6acf8", "c7247cb9a15ce08bfb22e43c65cfe6c90c3c7493", "e36370f93cda87df77dddbe1a00a8dcc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Kuiper

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Kuiper IOCs rule, tailored to a legitimate enterprise environment:

• Scenario: Enterprise Antivirus Signature Updates

  • Context: The organization uses Microsoft Defender for Endpoint or Symantec Endpoint Protection. During scheduled nightly updates (e.g., 02:00 AM), the AV engine downloads and installs new definition signatures from the vendor’s cloud repository. These signature files often contain hashes that overlap with the Kuiper IOC list, triggering a match on the C:\ProgramData\Microsoft\Windows Defender\Platform directory or similar paths.
  • Filter/Exclusion: Create an exclusion rule for the specific process names (MsMpEng.exe, Symantec Antivirus Client) and exclude file paths containing \Updates\ or \Definition\. Additionally, filter out events occurring during the defined maintenance window (e.g., 01:30–04:00 local time).

• Scenario: Scheduled Cloud Backup Jobs

  • Context: The IT operations team runs a daily backup job using Veeam Backup & Replication or Rubrik. These tools frequently scan and hash large volumes of data, including system logs and configuration files. If the Kuiper IOCs include hashes for common log formats or specific library files used by these backup agents, the scanning process will generate hits on legitimate backup metadata files located in C:\Veeam\Backup or /var/lib/rubrik.
  • Filter/Exclusion: Exclude file paths matching the backup agent’s working directories (e.g., *Veeam*, *Rubrik*). Implement a filter to ignore alerts where the parent process is the backup service executable (vbrsvc.exe or rubrik-agent) and the event type is “File Scan” rather than ”