ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the KongTuke campaign by identifying the presence of nine specific indicators of compromise within network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical due to the campaign’s high severity and its potential to establish persistent footholds through targeted phishing or supply chain attacks before broader detection occurs.

IOC Summary

Malware Family: KongTuke Total IOCs: 9 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["tommy-nn.lol", "goncllves.click", "monterro.click"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://monterro.click/api/v1/status", "https://tommy-nn.lol/f", "https://goncllves.click/api/v1/session", "https://goncllves.click/api/v1/verify", "https://monterro.click/api/v1/session", "https://monterro.click/api/v1/verify"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Backup Jobs Utilizing Known Hashes

  • Context: Enterprise backup solutions often use standardized agents that generate file hashes matching known benign software. If the backup agent (e.g., Veeam or Commvault) executes a scan or transfer task involving a specific DLL or executable hash included in the KongTuke IOC list, it triggers an alert.
  • Filter/Exclusion: Create a whitelist rule excluding process paths containing Veeam\BackupService or Commvault\Agent. Additionally, filter out events where the parent process is vssvc.exe (Volume Shadow Copy Service) running during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Admin Deployment of Patched Software via SCCM

  • Context: System administrators frequently use Microsoft Endpoint Configuration Manager (SCCM/MECM) to push software updates. If a specific patch installer or dependency library matches one of the KongTuke IOCs, the deployment engine will generate a detection hit across hundreds of endpoints simultaneously.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (SCCM agent) and the user context is NT AUTHORITY\SYSTEM. Implement a logic filter to suppress alerts if the event count for that specific IOC exceeds 50 occurrences within a 1-hour window, indicating a mass deployment rather than a targeted attack.

• Scenario: Internal DevOps CI/CD Pipeline Execution

  • Context: In environments using Jenkins or GitLab Runners on-premise, build agents often download and execute dependencies that may share hashes with the KongTuke IOCs