ThreatFox: Tsundere IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Tsundere threat actor by identifying specific Indicators of Compromise (IOCs) that signal potential reconnaissance or initial access attempts within the environment. A proactive search in Azure Sentinel is critical because early identification of these high-severity IOCs enables rapid containment before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Tsundere Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["31.76.96.195", "31.76.96.194"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.76.96.195", "31.76.96.194"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tsundere

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusion strategies for the ThreatFox: Tsundere IOCs rule:

• Scenario 1: Scheduled Antivirus Definition Updates via Microsoft Endpoint Configuration Manager (MECM)

  • Context: The enterprise utilizes SCCM/MECM to push daily definition updates. The update client often queries external repositories that share IP ranges or hash signatures with the Tsundere IOCs, triggering a match during the scheduled maintenance window (e.g., 02:00 AM).
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (ccmexec.exe or wuauclt.exe) combined with a Time-of-Day filter. Exclude alerts generated between 01:00 and 04:00 UTC originating from the SCCM management server subnet.

• Scenario 2: Automated Cloud Backup Agent Communication (Veeam or Commvault)

  • Context: The backup infrastructure runs nightly jobs where the Veeam/Commvault agent establishes connections to cloud storage gateways. These agents frequently initiate outbound connections to specific IPs that overlap with Tsundere’s network indicators, particularly when downloading metadata or verifying checksums.
  • Filter/Exclusion: Implement a filter excluding traffic from known backup service accounts (e.g., vss.exe, commvault_agent) where the destination port is restricted to standard backup ports (e.g., 9400, 8765) and the source IP belongs to the dedicated “Backup Infrastructure” VLAN.

• Scenario 3: Third-Party SaaS Integration for Identity Governance (SailPoint or Okta)

  • Context: The identity governance platform performs hourly synchronization jobs with external HR systems or cloud directories. These integrations utilize API endpoints that may resolve to IP addresses flagged by the Tsund