ThreatFox: OrBit IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity by matching network and endpoint telemetry against three specific indicators of compromise (IOCs) linked to the OrBit threat actor, enabling the identification of potential initial access or command-and-control communications. The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly detect early-stage intrusions associated with this high-severity campaign before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: OrBit Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`068fe402eb8cdbb0fe21f972ac4a23fa`	payload	2026-07-27	95%
sha1_hash	`c71045ed086daee981779b0bd7f63ca426040b80`	payload	2026-07-27	95%
sha256_hash	`3da1a4045d67c272137310c4df4ef6dfd0fbae684ac8c0fc76b4f2e31eb8138a`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - OrBit
let malicious_hashes = dynamic(["068fe402eb8cdbb0fe21f972ac4a23fa", "c71045ed086daee981779b0bd7f63ca426040b80", "3da1a4045d67c272137310c4df4ef6dfd0fbae684ac8c0fc76b4f2e31eb8138a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — OrBit

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: OrBit IOCs detection rule in an enterprise environment:

Scenario: Scheduled Endpoint Protection Scans
- Context: The organization’s EDR agent (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a daily scheduled scan that queries internal threat intelligence feeds. If the feed includes OrBit signatures, the scanner may generate network traffic or process creation events matching the OrBit IOCs during maintenance windows.
- Filter/Exclusion: Create an exclusion based on the Process Name and Schedule Time. Exclude alerts where the parent process is MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) occurring between 02:00 and 04:00 local time.
Scenario: IT Admin Manual Threat Research
- Context: Security analysts in the SOC manually investigate a separate incident by querying the OrBit platform directly via their workstation browser or CLI tools (e.g., PowerShell scripts running curl against the OrBit API). This generates legitimate traffic matching the IOCs.
- Filter/Exclusion: Exclude alerts originating from specific IP ranges assigned to the SOC team’s workstations (e.g., 10.50.20.0/24) or where the user account belongs to the SOC-Admins Active Directory group.
Scenario: Third-Party SIEM Integration Sync
- Context: The enterprise SIEM (e.g., Splunk Enterprise Security or IBM QRadar) runs a nightly connector job that pulls IOCs from ThreatFox/OrBit to update its internal threat library. This synchronization process triggers the detection logic as it ingests the OrBit data stream.
- Filter/Exclusion: Implement a rule exclusion for events where