ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the SmartApeSG threat actor to identify potential early-stage intrusions within the Azure Sentinel environment. Proactively hunting for these IOCs is critical because it enables the SOC team to rapidly isolate and investigate high-severity threats before they escalate into broader lateral movements or data exfiltration events.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 3 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["mulberrylodestar.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://mulberrylodestar.top/metrics/api-transpiler", "https://mulberrylodestar.top/metrics/signin-fetch.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Updates via Intune

  • Context: The Microsoft Intune service account triggers a scheduled task to download definition updates from the smartape-sg.com repository (a known vendor or partner feed) on all managed endpoints. This generates network traffic and file hash matches against the rule’s IOCs during the update window.
  • Filter/Exclusion: Exclude process executions where the parent process is Microsoft.Win32.Service or CmService.exe (Intune Agent) and the source IP belongs to the internal Intune management subnet (e.g., 10.50.x.x). Additionally, filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Automated Security Tooling Scans by CrowdStrike Falcon

  • Context: The CrowdStrike Falcon sensor performs a daily “Application Whitelisting” scan, querying external reputation services. If SmartApeSG is listed as a trusted vendor in the CrowdStrike cloud configuration, the sensor generates telemetry traffic that matches the rule’s IOCs during the scan cycle.
  • Filter/Exclusion: Create an exclusion for process names C-Service.exe and CSFalconUI.exe. Filter events where the “Action Type” is marked as “Reputation Check” or “Cloud Query” rather than “Execution,” ensuring only actual file executions trigger alerts, not passive reputation lookups.

• Scenario: Admin-Driven Patch Deployment via SCCM (MECM)

  • Context: A System Center Configuration Manager (SCCM) deployment job pushes a specific security patch package to the `