ThreatFox: Tsundere IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Tsundere threat actor by identifying specific Indicators of Compromise (IOCs) that signal potential reconnaissance or initial access attempts within the network. A SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify and contain early-stage Tsundere campaigns before they escalate into broader data exfiltration or lateral movement incidents.

IOC Summary

Malware Family: Tsundere Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`93[.]152[.]223[.]222:80`	botnet_cc	2026-07-29	75%
ip:port	`93[.]152[.]223[.]224:80`	botnet_cc	2026-07-29	75%
ip:port	`23[.]94[.]252[.]80:80`	botnet_cc	2026-07-29	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["93.152.223.222", "93.152.223.224", "23.94.252.80"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["93.152.223.222", "93.152.223.224", "23.94.252.80"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Tsundere

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Tsundere IOCs detection rule in an enterprise environment:

Endpoint Security Agent Updates
- Scenario: The organization’s endpoint protection suite (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) performs a scheduled definition update. The update package often includes new telemetry signatures that match the specific hash or URL IOCs associated with the Tsundere campaign, triggering an alert on all managed workstations during the maintenance window.
- Filter/Exclusion: Create a rule exclusion based on the Process Name of the security agent updater (e.g., MsMpEng.exe, FalconSensorService.exe) and limit the scope to specific time windows (e.g., 02:00–04:00 UTC) where updates are known to occur.
IT Asset Management & Inventory Scans
- Scenario: Automated inventory tools like Lansweeper, PDQ Deploy, or SCCM (System Center Configuration Manager) run scheduled discovery jobs that query external vendor repositories. These tools frequently download configuration manifests or software catalogs from the same cloud storage buckets or CDN endpoints flagged as Tsundere IOCs to verify asset compliance.
- Filter/Exclusion: Exclude network traffic originating from specific Service Accounts used by inventory tools (e.g., svc-lansweeper, CCMService) and filter out connections where the destination port is standard HTTP/HTTPS (80/443) but the source process is a known management utility.
Third-Party Cloud Backup & Synchronization
- Scenario: Enterprise backup solutions such as Veeam, Rubrik, or Acronis Cyber Protect initiate scheduled synchronization jobs to cloud repositories. The Tsundere IOCs may correspond to legitimate API endpoints used by these vendors