← Back to SOC feed Coverage →

ThreatFox: SmartApeSG IOCs

ioc-hunt HIGH ThreatFox
DnsEventsUrlClickEvents
iocjs-smartapesgthreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-06-19T23:00:00Z · Confidence: high

Hunt Hypothesis

The ThreatFox: SmartApeSG IOCs rule detects potential adversary activity linked to the SmartApeSG threat group, which is associated with malware distribution and command-and-control infrastructure. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate early-stage compromise attempts by this sophisticated threat actor.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 3 IOC Types: domain, url

TypeValueThreat TypeFirst SeenConfidence
urlhxxps://ivorycourtyard.top/middleware/version-schemapayload_delivery2026-06-19100%
domainivorycourtyard.toppayload_delivery2026-06-19100%
urlhxxps://ivorycourtyard.top/middleware/endpoint-asset.jspayload_delivery2026-06-19100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["ivorycourtyard.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://ivorycourtyard.top/middleware/version-schema", "https://ivorycourtyard.top/middleware/endpoint-asset.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled
UrlClickEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://threatfox.abuse.ch/browse/malware/js.smartapesg/