ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the KongTuke campaign by identifying specific indicators of compromise (IOCs) that signal potential initial access or lateral movement within the environment. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify and contain early-stage infections before they escalate into broader data exfiltration or ransomware events.

IOC Summary

Malware Family: KongTuke Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["tom-yy.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://griffihhs.click/api/v1/status", "https://tom-yy.top/f"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Third-Party Tools

  • Context: Enterprise endpoints running CrowdStrike Falcon or SentinelOne often perform scheduled definition updates. The update mechanism may download a specific configuration file or hash that matches one of the KongTuke IOCs (e.g., a generic installer hash used by multiple vendors).
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (FalconSensor.exe or SentinelOneAgent.exe) and the Parent Process (svchost.exe). Additionally, exclude traffic originating from known update server IP ranges (e.g., 13.229.0.0/16 for CrowdStrike) during standard maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Admin Deployment of Internal Security Tools via SCCM

  • Context: The IT operations team uses Microsoft Endpoint Configuration Manager (SCCM) to deploy a new internal security agent or patch. The deployment package includes an executable that shares the same SHA-256 hash as a KongTuke IOC, triggering the alert during mass rollout events.
  • Filter/Exclusion: Implement a filter excluding alerts where the Installation Source is identified as “SCCM” (via custom attribute) and the User Context matches the DOMAIN\AdminGroup. Alternatively, whitelist the specific SCCM deployment job ID associated with this security tool update in the SIEM correlation rule.

• Scenario: Automated Backup Jobs Executing on File Servers

  • Context: A nightly backup job utilizing **Veeam Backup &