ThreatFox: AMOS IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring for five specific Indicators of Compromise (IOCs) linked to the AMOS threat actor within Azure Sentinel logs. Proactive hunting for these IOCs is critical because early identification of AMOS-related artifacts enables the SOC team to rapidly contain potential intrusions before they escalate into broader compromises.

IOC Summary

Malware Family: AMOS Total IOCs: 5 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AMOS
let malicious_domains = dynamic(["feather-24.com", "haven-vibe.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["https://feather-24.com/curl/50919cfb07265cc6116b5ced7fbdb9c8f5e214445eea436e93e2c88d70da7e43", "https://haven-vibe.com/api/metrics/run?event=pasted", "https://feather-24.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/code3/update"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters/exclusions for the ThreatFox: AMOS IOCs detection rule:

• Scenario: Security Team Manual IOC Hunting

  • Context: Threat hunters or SOC analysts manually query the SIEM or EDR console using known AMOS indicators (hashes, domains) to validate a recent alert. This activity triggers the “Hunt package for 5 IOCs” logic as the system processes these queries against the active threat feed.
  • Filter/Exclusion: Exclude events where the source_user belongs to the Security_Ops or SOC_Analysts Active Directory group, and the process_name is a known security tool (e.g., Splunkd.exe, SentinelOneAgent.exe, CrowdStrikeService.exe).

• Scenario: Scheduled Endpoint Protection Updates

  • Context: The enterprise endpoint protection solution (e.g., Microsoft Defender for Endpoint or Carbon Black) runs a scheduled job at 02:00 UTC to pull the latest ThreatFox AMOS feed. This automated ingestion process generates network traffic and file hash checks that match the rule’s detection logic.
  • Filter/Exclusion: Create an exclusion based on scheduled_task_name matching “ThreatFeedUpdate” or “DailyIOCRefresh,” and restrict the filter to run only during the maintenance window (e.g., 01:00–04:00 UTC).

• Scenario: Automated Compliance Scanning by Third-Party Tools

  • Context: A compliance automation tool (such as Qualys, Tenable, or a custom PowerShell script running via System Center Configuration Manager) performs daily vulnerability and threat intelligence scans. These tools often query the AMOS IOC database to cross-reference asset configurations, triggering the detection rule.
  • **Filter/Ex