ThreatFox: OtterCookie IOCs

Hunt Hypothesis

This hunt targets the presence of four specific IOCs linked to the OtterCookie threat actor, indicating potential compromise or reconnaissance activity within the environment. Proactively hunting for these indicators allows the SOC team to identify and isolate affected assets before the adversary can establish persistence or exfiltrate data.

IOC Summary

Malware Family: OtterCookie Total IOCs: 4 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - OtterCookie
let malicious_ips = dynamic(["138.226.247.152"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.226.247.152"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - OtterCookie
let malicious_urls = dynamic(["https://www.jsonkeeper.com/b/7EBZP", "https://www.jsonkeeper.com/b/PAB1R", "http://138.226.247.152:80/session/0f2a3fba69d29493"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — OtterCookie

False Positive Guidance

• Scenario: A DevOps team uses curl or wget to download a specific build artifact or library from a public GitHub repository or internal artifact registry (e.g., JFrog Artifactory) that happens to be hosted on an IP address or domain listed in the OtterCookie IOC set.

  • Filter/Exclusion: Exclude alerts where the user agent string contains curl, wget, or python-requests, and the destination port is 443 (HTTPS) or 80 (HTTP), provided the source host is a known CI/CD runner or build server.

• Scenario: An application monitoring agent (such as Datadog, New Relic, or Splunk Universal Forwarder) initiates an outbound connection to a collector endpoint that shares an IP range or domain with an OtterCookie C2 server, often due to overlapping public IP allocations or shared hosting providers.

  • Filter/Exclusion: Exclude alerts where the process name is a known monitoring agent binary (e.g., datadog-agent, newrelic-agent, splunkforwarder) and the connection is initiated by a service account rather than an interactive user session.

• Scenario: A legacy line-of-business application performs a periodic health check or license validation by connecting to a vendor’s update server, which coincidentally matches one of the OtterCookie IOCs due to a recent IP reassignment or shared infrastructure.

  • Filter/Exclusion: Exclude alerts where the source process is a known legacy application executable (e.g., legacy_app.exe, vendor_tool.exe) and the connection occurs during a scheduled task window (e.g., every 24 hours at 02:00 AM) with no user interaction.

• Scenario: A network scanner or vulnerability assessment tool (such as Nessus, Qualys, or Nmap) probes