ThreatFox: Payload IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known ThreatFox payload indicators to identify compromised assets that may be executing malicious code or staging further intrusions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate high-severity threats before they progress to lateral movement or data exfiltration.

IOC Summary

Malware Family: Payload Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`95[.]220[.]193[.]183:22`	botnet_cc	2026-09-21	80%
ip:port	`79[.]36[.]29[.]167:22`	botnet_cc	2026-09-21	80%
ip:port	`106[.]12[.]70[.]210:8829`	payload_delivery	2026-09-21	85%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Payload 
let malicious_ips = dynamic(["106.12.70.210", "95.220.193.183", "79.36.29.167"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.12.70.210", "95.220.193.183", "79.36.29.167"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Payload

False Positive Guidance

Automated Malware Scanning by EDR/Antivirus Agents:
- Scenario: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or standalone antivirus tools (e.g., Kaspersky, Bitdefender) may download or stage temporary payload files to disk for heuristic analysis or signature matching. If the specific IOCs (hashes, file paths, or registry keys) associated with the “Payload” threat are used as test cases or match generic staging directories, the rule will trigger.
- Filter/Exclusion: Exclude processes where the parent executable is a known EDR/AV agent (e.g., FalconSensor.exe, MsMpEng.exe, klnagent.exe) and the file path resides within the vendor’s specific quarantine or staging directory (e.g., C:\Program Files (x86)\Kaspersky Lab\... or C:\ProgramData\Microsoft\Windows Defender\...).
Software Deployment via Group Policy or Configuration Management:
- Scenario: IT administrators deploy software updates or new applications using tools like SCCM (System Center Configuration Manager), PDQ Deploy, or Ansible. These tools often extract installer payloads to temporary directories (e.g., C:\Windows\Temp, C:\Users\%USERNAME%\AppData\Local\Temp) before execution. If the IOCs include specific file names or hash values that match the deployed installer binaries, the rule will fire during routine patch cycles.
- Filter/Exclusion: Exclude events where the initiating process is a deployment agent (e.g., ccmexec.exe for SCCM, pdqdeploy.exe, ansible-playbook.exe) and the file location is within standard temporary or deployment staging paths. Additionally, exclude if the event occurs during a known maintenance window defined in the CMDB.