ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network and endpoint telemetry against a curated set of 25 Indicators of Compromise (IOCs) specific to the Kuiper threat campaign. SOC teams should proactively hunt for these signals in Azure Sentinel to rapidly detect early-stage intrusions from this known actor, enabling immediate containment before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Kuiper Total IOCs: 25 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`bd80118b2d3b194746e0544a0a0dd40b6927497b`	payload	2026-08-01	95%
md5_hash	`fcccf56311c8847ce1f6d903ae8b06b7`	payload	2026-08-01	95%
md5_hash	`d5c5305780b5a5991cf48e95c0471752`	payload	2026-08-01	95%
sha256_hash	`af816bd1922f161670d19a9d70271722383c817590dfe047bbedca288e451e81`	payload	2026-08-01	95%
sha256_hash	`6a9ee6928a8e0fbd46bcd8fd9ad63e57eab47a53e36bbf6f29e24c842cd5b4a3`	payload	2026-08-01	95%
sha1_hash	`a7e03b28cbcce69347d7ccc512dc8dcbf783047b`	payload	2026-08-01	95%
sha256_hash	`9f68c786b0d24c5dbc927ee347a3c6de9c4351a78de73f0c1128e8f7ee969431`	payload	2026-08-01	95%
sha1_hash	`3a995d308ae14ec68bd10bc39d980f5666852749`	payload	2026-08-01	95%
md5_hash	`0e26b038fdb402105a64e739d9c15ce1`	payload	2026-08-01	95%
md5_hash	`f4ab00de1cb614c8a3bd107e3510d644`	payload	2026-08-01	95%
sha256_hash	`7341fa7b28bdc411c4f73c171c036cf5cdd57b7fcd2b006231ac92c324a829fe`	payload	2026-08-01	95%
sha1_hash	`d476f801a5990b26053a220597b883eae8a3bfa5`	payload	2026-08-01	95%
md5_hash	`16933fd1b134aa8c14a565df666ae354`	payload	2026-08-01	95%
sha256_hash	`44831dd69bd290d69459f93ac7b4378bd09ec9fb1ccac4e9f7d34dec7b068402`	payload	2026-08-01	95%
sha1_hash	`e40a908755fe24ddc119ddaa1fca5f3987b086e8`	payload	2026-08-01	95%
sha256_hash	`e0e69bb3ffd353720874b03724fa6e8cf51021ba5ff2676582dbff4d44ee234e`	payload	2026-08-01	95%
sha1_hash	`8f4c7b0cf9fc707f958f39511db9c08aaa138397`	payload	2026-08-01	95%
md5_hash	`aa69639fd234c6539cca524691fd4224`	payload	2026-08-01	95%
sha256_hash	`3b3c5e377794422830e760be0522cebb92c8272a491fb93aa74b3be21a48b6ff`	payload	2026-08-01	95%
sha1_hash	`0997a25ad1d0b1103448f98d437aaef1acec9dcd`	payload	2026-08-01	95%
md5_hash	`a4478bd1afe068a0bb192860d86afad8`	payload	2026-08-01	95%
sha256_hash	`c28a7bf288adab51e1371dddf98d10cd81c6099cd346e6093f50b367c2cd0b46`	payload	2026-08-01	95%
sha1_hash	`cf4605dfe70e8b4bded243ccea537b2a56fbcab7`	payload	2026-08-01	95%
md5_hash	`0b8921f4f4ce4e08916dc4a718038aee`	payload	2026-08-01	95%
sha256_hash	`9250e9fd0d73df09d608a544d27f048089071562ceb40de3600e9b5d85fa5f50`	payload	2026-08-01	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["bd80118b2d3b194746e0544a0a0dd40b6927497b", "fcccf56311c8847ce1f6d903ae8b06b7", "d5c5305780b5a5991cf48e95c0471752", "af816bd1922f161670d19a9d70271722383c817590dfe047bbedca288e451e81", "6a9ee6928a8e0fbd46bcd8fd9ad63e57eab47a53e36bbf6f29e24c842cd5b4a3", "a7e03b28cbcce69347d7ccc512dc8dcbf783047b", "9f68c786b0d24c5dbc927ee347a3c6de9c4351a78de73f0c1128e8f7ee969431", "3a995d308ae14ec68bd10bc39d980f5666852749", "0e26b038fdb402105a64e739d9c15ce1", "f4ab00de1cb614c8a3bd107e3510d644", "7341fa7b28bdc411c4f73c171c036cf5cdd57b7fcd2b006231ac92c324a829fe", "d476f801a5990b26053a220597b883eae8a3bfa5", "16933fd1b134aa8c14a565df666ae354", "44831dd69bd290d69459f93ac7b4378bd09ec9fb1ccac4e9f7d34dec7b068402", "e40a908755fe24ddc119ddaa1fca5f3987b086e8", "e0e69bb3ffd353720874b03724fa6e8cf51021ba5ff2676582dbff4d44ee234e", "8f4c7b0cf9fc707f958f39511db9c08aaa138397", "aa69639fd234c6539cca524691fd4224", "3b3c5e377794422830e760be0522cebb92c8272a491fb93aa74b3be21a48b6ff", "0997a25ad1d0b1103448f98d437aaef1acec9dcd", "a4478bd1afe068a0bb192860d86afad8", "c28a7bf288adab51e1371dddf98d10cd81c6099cd346e6093f50b367c2cd0b46", "cf4605dfe70e8b4bded243ccea537b2a56fbcab7", "0b8921f4f4ce4e08916dc4a718038aee", "9250e9fd0d73df09d608a544d27f048089071562ceb40de3600e9b5d85fa5f50"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment:

Scenario: Scheduled Antivirus or EDR Definition Updates
- Context: Enterprise endpoints running tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Sophos Intercept X often perform scheduled definition updates during off-hours. These agents may query external update servers that share IP ranges or domain names with the Kuiper IOC list, triggering a match on legitimate traffic flows.
- Suggested Filter: Exclude network connections originating from specific EDR update service accounts (e.g., MsiInstaller, CrowdStrikeService) and restrict the alert to business hours only if updates are known to occur outside that window. Alternatively, whitelist the specific IP ranges of the vendor’s update servers found in the IOC list against the rule logic.
Scenario: Cloud Backup and Synchronization Jobs
- Context: Automated backup agents such as Veeam, Rubrik, or Microsoft Azure Backup frequently establish outbound connections to cloud storage gateways. If a Kuiper IOC corresponds to a generic CDN IP or a specific cloud region used by these services, the rule will flag routine data synchronization tasks as potential threats.
- Suggested Filter: Create an exclusion for process names associated with backup agents (e.g., VeeamTransport.exe, rubrik-agent) and whitelist the destination IP addresses of known corporate cloud storage buckets or SaaS providers identified in the Kuiper dataset.
Scenario: Software Deployment via Configuration Management Tools
- Context: During patch cycles, tools like Microsoft SCCM (Configuration Manager), Ansible, or Jenkins pull software packages and dependencies from public repositories. These deployment pipelines often resolve to IPs that overlap with the Kuiper IOC set, particularly if the