ThreatFox: Ngioweb IOCs

Hunt Hypothesis

This hunt targets the presence of Ngioweb IOCs to identify potential web shell deployments or compromised endpoints that adversaries may use for persistent access and command execution. Proactively hunting for these indicators in Azure Sentinel is critical because Ngioweb is a known web shell often leverized for initial access and lateral movement, allowing the SOC to detect and isolate compromised assets before they are fully exploited.

IOC Summary

Malware Family: Ngioweb Total IOCs: 5 IOC Types: url, sha256_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Ngioweb
let malicious_ips = dynamic(["145.249.115.184"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["145.249.115.184"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Ngioweb
let malicious_urls = dynamic(["http://118.145.196.225:800/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ngioweb
let malicious_hashes = dynamic(["1631e63ee373601c1f42f2674f996fc6c14dc6aebe45ca5d2395bf347a0e3661", "1b831a9366cd53a4127f885dab247bc2f0b3f661a7d9d9510bbd0a9f150bfb27", "52bff4bf58eb6031c16763b12b696e849a38f36e69c55402a444819cb9c1bc0e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Ngioweb

False Positive Guidance

• Scenario: A web development team deploys a new staging environment using a popular open-source CMS (e.g., WordPress or Joomla) that includes default sample content or plugin bundles. The Ngioweb IOCs may match specific file paths, hashes, or registry keys associated with these standard components, triggering the rule during initial deployment or automated CI/CD pipeline builds.

  • Filter/Exclusion: Exclude alerts where the source process is a known build agent (e.g., jenkins.exe, azureagent.exe, githubactions.exe) or where the parent process is a web server (e.g., w3wp.exe, nginx.exe) and the file path resides within a standard staging directory (e.g., C:\inetpub\wwwroot\staging\).

• Scenario: An IT administrator performs a routine patching or cleanup task on a shared file server, deleting or moving legacy application folders that were previously infected or contained known Ngioweb artifacts. The detection rule may trigger on the file system events (create/delete) or hash matches of the IOCs during this manual cleanup, especially if the files are being moved to a quarantine folder rather than deleted.

  • Filter/Exclusion: Exclude alerts where the user account belongs to a privileged group (e.g., Domain Admins, IT_Ops) and the action is a file move or delete operation targeting paths containing keywords like quarantine, backup, or legacy, provided the source and destination drives are the same or mapped network shares.

• Scenario: A security team runs a scheduled vulnerability scan or threat hunt using a tool like Nessus, Qualys, or a custom PowerShell script that deliberately touches or reads the specific IOCs to verify their presence or state. The rule may interpret the read/access events or temporary file creations by the scanner as malicious activity, particularly if the scanner runs under a service