ThreatFox: AMOS IOCs

Hunt Hypothesis

This hunt targets the presence of known AMOS threat indicators to identify potential compromise by this advanced malware family, which often leverages these IOCs for initial access or persistence. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to detect active or dormant AMOS infections early, mitigating the risk of lateral movement and data exfiltration before the adversary establishes a foothold in the environment.

IOC Summary

Malware Family: AMOS Total IOCs: 5 IOC Types: url, sha256_hash, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AMOS
let malicious_domains = dynamic(["maple30.com", "quillchant14.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["https://maple30.com/f/680apd_597afiqvimxvelw/sfjwmrjy", "https://quillchant14.com/curl/owe4d2uwalzu/gkgeuf4jglj8kmpnoqb.txt"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["ea55fa3a9aea8ae8a48ee68835f48079c668c2a916960318a65da7726269d2ee"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

• Legitimate Web Server Maintenance (Apache/Nginx)

  • Scenario: An administrator or automated script performs a curl request to a known ThreatFox AMOS IP address to verify SSL certificate validity, check HTTP response codes, or test failover configurations on a load balancer. The AMOS IOCs often include specific IP ranges or domains that may overlap with public cloud provider ranges or legitimate CDN endpoints.
  • Filter/Exclusion: Exclude events where the source process is curl.exe, wget.exe, or powershell.exe executing a script named check_ssl.ps1 or similar, and the destination port is 443. Additionally, exclude if the source user is part of the WebAdmins group and the event occurs during a scheduled maintenance window (e.g., 02:00–04:00 UTC).

• Backup Agent Communication (Veeam/Commvault)

  • Scenario: A backup agent on a file server communicates with a backup repository or proxy that happens to be hosted on an IP address listed in the AMOS IOC set. This can occur if the backup infrastructure uses public IP addresses for remote replication or if the IOC list includes a broad subnet that encompasses the backup server’s public-facing interface.
  • Filter/Exclusion: Exclude connections where the source process is vbrd.exe (Veeam Backup & Replication Daemon) or cvpp.exe (Commvault Protection Server) and the destination port is 8443 (Veeam) or 18000 (Commvault). Ensure the destination IP is explicitly whitelisted in the backup infrastructure inventory.

• Software Update Check (Adobe/Java)

  • Scenario: The Adobe Acrobat Reader or Java Runtime Environment performs a periodic update check by querying a known AMOS-associated domain or IP