ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating six specific Indicators of Compromise (IOCs) linked to the Kuiper threat intelligence feed within Azure Sentinel logs. Proactively hunting for these IOCs is critical because they represent known high-severity threats that may have already infiltrated the environment, allowing the SOC team to rapidly isolate affected assets and mitigate potential lateral movement before an incident escalates.

IOC Summary

Malware Family: Kuiper Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`ad5b27155e1f34fad298c6889dbc845692f5861ad7ea835c42e991640470909f`	payload	2026-07-25	95%
sha1_hash	`d96a9e4df85b326920258c21efe8b30205aee037`	payload	2026-07-25	95%
md5_hash	`0c2577473d74812f1236f9b799657b49`	payload	2026-07-25	95%
sha1_hash	`cae5fce1e51361e0c1b89119d9f0ca4a3a57ce1c`	payload	2026-07-25	95%
md5_hash	`de4b52b0f65e583ab1be4564a3e863c6`	payload	2026-07-25	95%
sha256_hash	`1fd16cdde518d79227aedb9cec2e3b69ee47727e119cd8cec611cf1320e61265`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["ad5b27155e1f34fad298c6889dbc845692f5861ad7ea835c42e991640470909f", "d96a9e4df85b326920258c21efe8b30205aee037", "0c2577473d74812f1236f9b799657b49", "cae5fce1e51361e0c1b89119d9f0ca4a3a57ce1c", "de4b52b0f65e583ab1be4564a3e863c6", "1fd16cdde518d79227aedb9cec2e3b69ee47727e119cd8cec611cf1320e61265"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment:

Scenario: Scheduled Endpoint Protection Updates via Microsoft Defender for Endpoint.
- Context: The organization utilizes a nightly maintenance window where the EDR agent (Microsoft Defender) automatically downloads definition updates and threat intelligence feeds from external sources. If the Kuiper IOC list contains hash values or URLs matching these update servers, the rule triggers during the scheduled job execution.
- Suggested Filter/Exclusion: Create an exclusion based on the process name MsMpEng.exe (or specific EDR agent binary) running under the SYSTEM account, limited to the specific time window of 02:00–04:00 UTC. Alternatively, exclude the specific destination IP ranges known for Microsoft Update services from the IOC matching logic.
Scenario: Automated Cloud Backup Jobs using Veeam or Commvault.
- Context: Enterprise backup solutions often initiate connections to external cloud storage buckets (e.g., AWS S3, Azure Blob) or vendor management portals that may share IP addresses or domain names with the Kuiper IOC list. When a scheduled backup job runs, it establishes outbound connections that match the detection logic.
- Suggested Filter/Exclusion: Implement a filter to exclude traffic initiated by specific service accounts (e.g., VeeamBackupSvc or CommvaultAgent) connecting to known cloud provider CIDR blocks. Add these backup destination IPs/domains to a “Trusted External” allow-list within the detection rule configuration.
Scenario: Software Deployment via SCCM/Intune or Ansible Automation.
- Context: During patching cycles, Configuration Management tools (like Microsoft Endpoint Manager or Ansible Tower) download software packages and manifests from vendor repositories. If a deployed application package contains a