ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with the KongTuke threat actor by identifying network and host artifacts matching six specific Indicators of Compromise (IOCs). Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage intrusions and mitigate potential data exfiltration before the adversary establishes persistence.

IOC Summary

Malware Family: KongTuke Total IOCs: 6 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["nodemetrics9095.com", "meduurst.space"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://meduurst.space/api/v1/status", "https://nodemetrics9095.com/update/package", "https://meduurst.space/api/v1/session", "https://meduurst.space/api/v1/verify"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, tailored for an enterprise environment:

• Antivirus Endpoint Scanning of Quarantine Archives

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently download and scan large threat intelligence archives containing historical malware samples. If the KongTuke IOCs are embedded within these generic “Threat Intelligence Feed” packages, the scanning process will trigger the rule as if the enterprise is actively processing a new KongTuke infection.
  • Filter/Exclusion: Exclude traffic or file hash events where the parent process belongs to known AV engines (e.g., csagent.exe, MsMpEng.exe) and the destination path matches the standard quarantine or feed update directory (e.g., \ProgramData\Microsoft\Windows Defender\Updates).

• Scheduled Threat Intelligence Feed Ingestion by SIEM/SOAR

  • Scenario: Security Operations teams often run scheduled jobs to ingest external threat feeds into their SIEM (e.g., Splunk, IBM QRadar) or SOAR platform. During the nightly ingestion window, a parser service might download and process raw IOC lists from ThreatFox. The detection logic may flag these internal parsing activities as active network connections or file accesses matching the KongTuke IOCs.
  • Filter/Exclusion: Create an exclusion based on the source host identity (e.g., SIEM-INGEST-SRV01) and restrict alerts to specific time windows outside of business hours (e.g., 02:00–04:00 UTC) when these scheduled ingestion jobs typically run.

• Red Team Simulation or Purple Team Exercises

  • Scenario: Internal security teams regularly conduct “Purple Teaming” exercises where they simulate known threat actors to test detection efficacy. During