ThreatFox: Tsundere IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Tsundere threat actor by monitoring specific Indicators of Compromise (IOCs) that signal potential reconnaissance or initial access attempts within the Azure Sentinel environment. A SOC team should proactively hunt for these IOCs to rapidly identify and isolate early-stage compromises, thereby preventing lateral movement before the attacker establishes a persistent foothold in critical systems.

IOC Summary

Malware Family: Tsundere Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["23.94.252.7", "2.27.248.80"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.94.252.7", "2.27.248.80"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tsundere

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Tsundere IOCs detection rule:

• Scenario: Scheduled Antivirus Definition Updates via Cloud Connectors

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon often initiate background connections to update servers that share IP ranges or domain structures with the Tsundere threat infrastructure. These scheduled jobs (e.g., MpCmdRun.exe or FalconSensorService) generate network traffic matching the rule’s IOCs during peak maintenance windows (typically 02:00–04:00 UTC).
  • Suggested Filter: Exclude alerts where the source process name matches known AV update executables (MpCmdRun.exe, FalconService.exe, ccSvcHst.exe) AND the connection destination falls within the organization’s approved “Trusted Cloud Services” allow-list IP range.

• Scenario: Automated Backup and Archive Jobs

  • Context: Centralized backup solutions like Veeam Backup & Replication or Rubrik frequently utilize external storage gateways that may resolve to domains or IPs overlapping with Tsundere’s IOCs. When the nightly backup job (vbr.exe or rubrikservice) initiates a data sync, it triggers network flows that mimic the threat signature.
  • Suggested Filter: Create an exclusion for alerts originating from the specific Service Accounts used by backup infrastructure (e.g., DOMAIN\svc-veeam-backup, DOMAIN\svc-rubrik) where the destination port is standard HTTPS (443) or a known storage protocol port (e.g., 8080, 9000).

• Scenario: Third-Party SaaS Integration Webhooks

  • Context: The organization’s **ServiceNow