ThreatFox: BeaverTail IOCs

Hunt Hypothesis

This hunt targets the presence of seven specific IOCs linked to the BeaverTail threat actor, indicating potential compromise or reconnaissance activity within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate affected assets before the adversary can establish persistence or exfiltrate data.

IOC Summary

Malware Family: BeaverTail Total IOCs: 7 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - BeaverTail
let malicious_ips = dynamic(["51.210.52.212"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["51.210.52.212"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - BeaverTail
let malicious_urls = dynamic(["https://gamboracle.vercel.app/api", "http://51.210.52.212:1224/api/checkStatus", "https://ip-vm.vercel.app/api/settings/mac", "https://ip-vm.vercel.app/api/settings/linux", "https://ip-vm.vercel.app/api/settings/windows", "https://ip-vm.vercel.app/api/settings/env"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — BeaverTail

False Positive Guidance

• Scenario: A DevOps team uses a custom Python script or PowerShell wrapper to automate the deployment of a new internal microservice, where the script explicitly checks for the presence of specific file hashes or registry keys (matching BeaverTail IOCs) to verify environment integrity before proceeding.
  • Filter/Exclusion: Exclude alerts where the parent process is a known scripting engine (e.g., python.exe, powershell.exe, pwsh.exe) and the command line contains keywords like verify, check, integrity, or deploy.
• Scenario: An IT administrator runs a full-system scan using a third-party endpoint detection and response (EDR) tool or a standalone AV engine (e.g., Malwarebytes, Kaspersky, or CrowdStrike Falcon) that includes the BeaverTail threat feed in its signature database, causing the scanner process to touch the IOCs during a scheduled maintenance window.
  • Filter/Exclusion: Exclude alerts where the parent process is a known security scanner binary (e.g., falconctl.exe, mbam.exe, kavsvc.exe) or where the process name matches common EDR/AV service executables.
• Scenario: A QA engineer testing a new application release uses a containerized environment (e.g., Docker or Kubernetes) where the test image includes a copy of the BeaverTail sample files for regression testing, and the container runtime or sidecar proxy inspects the file system.
  • Filter/Exclusion: Exclude alerts originating from processes with names like dockerd, containerd-shim, kubelet, or crio, or where the working directory path contains /var/lib/docker/, /kublet/, or /tmp/test/.
• Scenario: A backup or archival job (e.g., Veeam, Commvault, or Windows Server Backup) restores or