ThreatFox: Tsunami IOCs

Hunt Hypothesis

This hunt identifies potential compromise by matching network traffic or asset indicators against known IOCs associated with the Tsunami threat actor. Proactively hunting for these signatures allows the SOC to detect early-stage reconnaissance or lateral movement activities before the adversary can establish a persistent foothold within the Azure environment.

IOC Summary

Malware Family: Tsunami Total IOCs: 3 IOC Types: ip:port, url, sha256_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsunami
let malicious_ips = dynamic(["45.198.224.184"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.198.224.184"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Tsunami
let malicious_urls = dynamic(["http://45.198.224.184/nix"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Tsunami
let malicious_hashes = dynamic(["e4710a6a8b66437f3a45ecae00d37f492654897b996891656a32547d25fc01b5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tsunami

False Positive Guidance

• Scenario: A DevOps team deploys a new containerized microservice that includes a shared library or binary with a known hash collision to one of the Tsunami IOCs, often triggered during automated CI/CD pipeline builds using Jenkins or GitHub Actions.

  • Filter/Exclusion: Exclude processes originating from specific CI/CD agent service accounts (e.g., jenkins-agent, github-actions-runner) or filter out events where the parent process is a container runtime like Docker (dockerd) or Kubernetes (kubelet), provided the container image tag matches the expected release version.

• Scenario: An IT administrator performs a manual patching or software update task using WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager), where a post-install script downloads a dependency package that matches an IOC hash, typically occurring during scheduled maintenance windows.

  • Filter/Exclusion: Exclude events where the initiating user belongs to the Domain Admins or IT_Patching security group and the process path resides in standard update directories such as C:\Windows\SoftwareDistribution\ or C:\Program Files\Microsoft Configuration Manager\.

• Scenario: A security engineer runs a baseline scan or vulnerability assessment using Nessus or Qualys agents, which temporarily loads a plugin or scanner module that shares a hash with a Tsunami IOC, often triggered by scheduled policy scans on weekends.

  • Filter/Exclusion: Exclude processes where the parent executable is a known scanning agent (e.g., nessus-agent.exe, qualys_agent.exe) or filter out events occurring within the specific time window of the scheduled scan (e.g., Saturday 02:00–04:00 UTC) if the source IP is from the internal scanning subnet.