ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity by identifying network connections and file artifacts matching seven specific Indicators of Compromise (IOCs) linked to the SmartApeSG threat actor. Proactively hunting for these IOCs within Azure Sentinel is critical because early detection of this high-severity campaign enables rapid containment before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 7 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["sorrelalmanac.top", "nebulaloom.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://sorrelalmanac.top/alias/legacy-dom", "https://sorrelalmanac.top/alias/acl-component.js", "https://nebulaloom.top/oauth/reset-dom.js", "https://nebulaloom.top/oauth/auth-server", "https://nebulaloom.top/oauth/gateway-html.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Defender

  • Scenario: The Microsoft Defender Antivirus service (MsMpEng.exe) automatically downloads signature updates or threat intelligence feeds from the cloud. If SmartApeSG IOCs include specific file hashes or URLs used by Microsoft’s update infrastructure, the endpoint agent may trigger a match during routine daily scans.
  • Filter/Exclusion: Create an exclusion in the detection logic to ignore alerts where the Process Name is MsMpEng.exe and the Parent Process is svchost.exe. Additionally, whitelist the specific hash of the Microsoft update client if it matches a known SmartApeSG IOC.

• Automated Backup Jobs Using Veeam or Commvault

  • Scenario: Scheduled backup jobs (e.g., running via Veeam Agent or Commvault) often replicate large datasets to cloud storage or on-prem repositories. If the backup software connects to a repository URL that matches one of the SmartApeSG network IOCs, or if the backup agent’s executable hash overlaps with an IOC, legitimate data transfer will be flagged as suspicious activity.
  • Filter/Exclusion: Implement a time-based exclusion for the rule during known maintenance windows (e.g., 02:00–04:00 UTC). Alternatively, add a filter to exclude traffic originating from specific backup service accounts (e.g., DOMAIN\VeeamBackupSvc) or IP ranges dedicated to the backup infrastructure.

• Software Deployment via SCCM/Intune

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Intune pushes application updates and patches to workstations. During a mass deployment,