ThreatFox: AMOS IOCs

Hunt Hypothesis

This hunt identifies potential compromise by matching network traffic or asset attributes against nine known IOCs linked to the AMOS threat actor, a group frequently associated with advanced persistent threats targeting enterprise environments. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage reconnaissance or lateral movement activities before they escalate into full-scale data exfiltration or ransomware deployment.

IOC Summary

Malware Family: AMOS Total IOCs: 9 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["89aad11bff0ba0d654016e4e95b02f6f94b18f01f09475b83b0d983ed0764af2", "15f5980c718cda6c5b16ea81cd153ebef15f07a03378594a669395c0d51c64ed", "d3552befdb5519741191cd15d8b6e5109c9f8bba584a4506b3c551253f993474", "6e2c9918a3eee4233cb3058385011fb7c79bf2f801655ff7711174196f1dcb59", "bd1b6bed346570b063a14e9f4f7ddf21b19f61dbe1f820e03401fe82c509fd7b", "33cb2391cc0a21681eb67b1b85ce43117641059494c249030be388fa178bbda2", "7243f66e3c28ef7d20a2ab34b30c577fe6f1f4273145a3379be7d3b9fea625a1", "f91311823973108b313e941881d0ba501569b59221585b05cb69d2baeba68a74", "ef3bec3fc56611025ea5c9e67197f70f8f9d625b3b08eaea7c444f7285264bad"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

• Scenario: The IT operations team deploys a new version of the AMOS (Automated Monitoring and Optimization System) internal tooling or updates its configuration files during a scheduled maintenance window. If the IOC list includes specific file hashes or registry keys associated with the AMOS agent, these legitimate updates will trigger the detection.

  • Filter/Exclusion: Exclude alerts where the source process is AMOSAgent.exe or AMOSUpdater.exe and the parent process is Task Scheduler (taskschd.msi) or Windows Update (wuauclt.exe). Alternatively, whitelist the specific file paths (e.g., C:\Program Files\InternalTools\AMOS\) for the duration of the deployment window.

• Scenario: A security engineer or developer is testing the AMOS integration in a non-production environment or staging server. They may manually copy AMOS binaries or configuration files to a test VM, or run the AMOS service under a user account that is not the standard service account, causing a mismatch in expected process lineage or file location.

  • Filter/Exclusion: Exclude alerts originating from hosts tagged with Environment: Staging or Environment: Dev in your CMDB or asset management system. Additionally, exclude if the user context is a known developer or QA account (e.g., dev-amos-test, qa-integration) and the host is not in the production domain.

• Scenario: A third-party backup solution (e.g., Veeam, Commvault, or Rubrik) creates shadow copies or temporary staging files for the AMOS database or configuration store. If the IOC includes specific file names or hashes for AMOS data files, the backup agent may write these files to a temporary directory (e.g., C:\Temp\BackupStaging\), triggering the file-based IOC.

  • **Filter/