ThreatFox: MintsLoader IOCs

Hunt Hypothesis

This hunt detects adversary activity consistent with the MintsLoader malware by identifying specific indicators of compromise (IOCs) that signal potential initial access or lateral movement within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain this high-severity threat before it establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: MintsLoader Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - MintsLoader
let malicious_domains = dynamic(["logintrust5845.lol", "syshash4392.top", "authservice6020.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — MintsLoader

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: MintsLoader IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Intune/SCCM

  • Scenario: During a scheduled maintenance window, the IT team pushes a new definition update or policy configuration to the endpoint. The deployment package includes a signed executable or script that matches one of the MintsLoader file hashes (e.g., a shared DLL used in multiple vendor tools) or triggers a network connection to an IOC IP address used by the EDR’s cloud management plane.
  • Filter/Exclusion: Create an exclusion for processes originating from C:\Program Files\Microsoft Intune Management Extension or C:\Windows\CCM (SCCM), specifically filtering out traffic destined for known Microsoft Azure Update IPs and whitelisting the specific file hashes associated with your internal update packages.

• Automated Third-Party Backup Agent Execution

  • Scenario: A scheduled job runs a backup agent (such as Veeam, Commvault, or Acronis) on a critical database server. The backup process initiates a temporary network connection to an external storage gateway or performs a file integrity check that generates a hash match for one of the MintsLoader IOCs, which may be a common library component shared by various enterprise utilities.
  • Filter/Exclusion: Exclude alerts where the parent process is vbr.exe (Veeam) or commvaultagent.exe, and restrict the rule to only trigger on user-initiated sessions rather than system-level scheduled tasks running under the NT AUTHORITY\SYSTEM account during non-business hours.

• Software Deployment via Ansible or Puppet Configuration Management

  • Scenario: An automated configuration management tool (like Ansible Tower or Puppet) executes a playbook to patch a fleet of web servers