ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific indicators of compromise (IOCs) linked to the SmartApeSG threat actor, which may signal active reconnaissance or initial access attempts within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this high-severity campaign allows the SOC team to rapidly isolate affected assets and mitigate potential lateral movement before broader compromise occurs.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 6 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["asterismchisel.top", "pewtercanto.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://asterismchisel.top/user/acl-dom", "https://asterismchisel.top/user/version-deploy.js", "https://pewtercanto.top/user/acl-dom", "https://pewtercanto.top/user/version-deploy.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Protection Engine Updates: The EDR agent (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) automatically downloads definition updates from a trusted vendor repository that shares the same IP address or domain hash as one of the SmartApeSG IOCs.

  • Filter/Exclusion: Create an exclusion rule based on the specific process name MsMpEng.exe (or FsHdService.exe) and restrict it to the known update server subnet or specific FQDN used by your EDR vendor, excluding traffic from internal workstations during maintenance windows.

• Scheduled Backup Jobs via Cloud Storage: A nightly scheduled task running a backup script (e.g., using Veeam Agent or Azure Data Box) connects to an external cloud storage endpoint that matches the SmartApeSG network IOC for data exfiltration patterns.

  • Filter/Exclusion: Exclude alerts where the source process is VeeamAgent.exe or a specific PowerShell script (BackupJob.ps1) running under the domain account svc-backup, and restrict the exclusion to the time window of 02:00–04:00 UTC.

• Third-Party SaaS Integration Webhooks: The enterprise CRM (e.g., Salesforce) or HR system triggers a webhook to an external analytics platform, generating network traffic that matches the SmartApeSG URL IOC for API communication.

  • Filter/Exclusion: Implement a whitelist exclusion for the specific FQDN of the integration partner (e.g., api.analytics-partner.com) and limit the scope to the application identity Salesforce-Connector running on the jump host server.

• IT Admin Manual Remediation Tasks: An