ThreatFox: LeetHozer IOCs

Hunt Hypothesis

This hunt targets the presence of specific IOCs linked to the LeetHozer threat actor, indicating potential compromise or reconnaissance activity within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and isolate affected assets before the adversary can establish persistence or execute further malicious actions.

IOC Summary

Malware Family: LeetHozer Total IOCs: 2 IOC Types: sha1_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - LeetHozer
let malicious_hashes = dynamic(["8f72fb281b388cbaa7ecdfaf6b16bf80247bf0e6a92daf5077ad7cd4f3aaeff2", "bd19ef461bf72bb041e441a09ab6da4f3455a4c5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — LeetHozer

False Positive Guidance

• Legacy Application Deployment via Group Policy: An IT administrator deploys a legacy line-of-business application (e.g., a specific version of Notepad++ or a custom internal tool) that includes a binary with a known hash or filename matching one of the LeetHozer IOCs (such as svchost.exe in a non-standard path or a specific .dll hash). This is often done via a GPO software installation task.
  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) or exclude processes where the parent is gpupdate.exe or cmd.exe initiated by a GPO task.
• Scheduled Maintenance Job for Third-Party Utilities: A scheduled task (e.g., Task Scheduler job named “Daily Backup Cleanup”) executes a third-party utility script or binary (like a specific version of 7z.exe or a custom cleanup script) that matches the IOC hash or filename. This is a routine, automated maintenance task.
  • Filter/Exclusion: Exclude processes where the parent is schtasks.exe or Task Scheduler service (svchost.exe with specific service arguments), or exclude paths under C:\Windows\System32\Tasks\ or the specific utility’s installation directory.
• Development or QA Environment Testing: A developer or QA engineer runs a test build of an application or a specific test harness in a non-production environment (e.g., D:\DevProjects\ or C:\QA\) that intentionally uses a binary or configuration file matching the IOC (e.g., a test copy of config.ini or a debug binary). This is common in isolated dev/qa zones.
  • Filter/Exclusion: Exclude hosts tagged as “Dev” or “QA”