ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the KongTuke malware campaign, which is known for targeting enterprise environments through malicious document exploitation and lateral movement. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before they escalate into broader network compromises, given the high severity and potential data exfiltration risks associated with this threat actor.

IOC Summary

Malware Family: KongTuke Total IOCs: 6 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["phiplips.click", "tommy-eg.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://phiplips.click/api/v1/session", "https://phiplips.click/api/v1/verify", "https://phiplips.click/api/v1/status", "https://tommy-eg.top/f"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update

  • Context: The WindowsUpdate service or a third-party agent (e.g., Defender for Endpoint) frequently downloads definition packages that match the hash or URL patterns of KongTuke IOCs due to shared infrastructure or overlapping vendor signatures. This often occurs during nightly maintenance windows.
  • Filter/Exclusion: Exclude processes where ParentProcessName is wuauserv.exe (Windows Update Agent) and the source IP belongs to the internal update server subnet (e.g., 10.x.x.x). Additionally, add a time-based exclusion for alerts generated between 02:00 and 04:00 UTC on weekdays.

• Scenario: Legitimate Cloud Backup Operations by Veeam or Rubrik

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize specific executable names or network ports that align with KongTuke IOCs when establishing connections to cloud storage repositories (e.g., AWS S3, Azure Blob) for incremental backups.
  • Filter/Exclusion: Create an exclusion rule based on the process name VeeamAgent.exe or rubrik-agent. If the detection logic monitors network traffic, exclude flows where the destination port is 443 and the destination hostname contains .veeam.com or .rubrik.cloud.

• Scenario: Automated Software Deployment via Microsoft SCCM/Intune

  • Context: During mass software deployments (e.g., pushing a new browser version or security patch), the Microsoft Endpoint Configuration Manager (SCCM) client (`ccmsetup.exe