ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the KongTuke threat actor, enabling the identification of potential intrusions within the Azure Sentinel environment. Proactively hunting for these IOCs is critical because it allows the SOC team to rapidly validate and contain early-stage threats before they escalate into broader compromises across the organization’s cloud infrastructure.

IOC Summary

Malware Family: KongTuke Total IOCs: 12 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["bouoher.lol", "aeshire.click", "barringer.click", "tommy-bb.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://bouoher.lol/api/v1/session", "https://bouoher.lol/api/v1/verify", "https://aeshire.click/api/v1/session", "https://aeshire.click/api/v1/verify", "https://barringer.click/api/v1/session", "https://barringer.click/api/v1/verify", "https://barringer.click/api/v1/status", "https://tommy-bb.lol/f"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Endpoint Security Engine Scanning of Historical Archives

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often perform deep scans of legacy archives or backup repositories. If a historical file containing a KongTuke sample hash was previously ingested into the backup system, the scanner may re-flag it during routine maintenance windows as a new detection rather than an archived asset.
  • Filter/Exclusion: Exclude alerts where the Process Name is C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe AND the File Path contains \Backup\ or \Archive\. Additionally, add a filter to suppress alerts if the file’s Last Modified Date is older than 90 days.

• Scenario: Scheduled Malware Analysis Jobs on Shared Network Drives

  • Context: IT administrators frequently schedule nightly jobs using tools like Veeam Backup & Replication or SolarWinds Storage Manager to scan shared network drives (e.g., \\FileServer\Public). If a KongTuke IOC hash exists within a public folder used by multiple departments, the scheduled job will trigger a detection every time it runs, even if the file is a known benign template.
  • Filter/Exclusion: Create an exclusion rule for alerts originating from specific Service Accounts (e.g., DOMAIN\VeeamSvc or DOMAIN\BackupAdmin) interacting with network paths starting with \\FileServer\. Configure the detection logic to ignore events where the User Type is “Service Account” and the Source IP belongs to the internal backup subnet.