ThreatFox: AMOS IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the AMOS malware family, which is frequently deployed to establish persistence and execute malicious payloads within Azure environments. Proactively hunting for these IOCs allows the SOC to identify potential intrusions early, mitigating the risk of lateral movement and data exfiltration before the adversary achieves their operational objectives.

IOC Summary

Malware Family: AMOS Total IOCs: 6 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`534b55b6772e5c2669f325bc877056c874a180650253e4bd5844ffaf69c384b6`	payload	2026-09-21	100%
sha256_hash	`a2da9aba412172006b2ba30e2168ec030dabcdf8c46e6895ffba1c26834251a6`	payload	2026-09-21	100%
sha256_hash	`382a3e22d91b93c67de463fde451870620e661b8e96f40a4ece80a2d3543a03f`	payload	2026-09-21	100%
sha256_hash	`c254bf1cd9ab1496ad01785ed181bd6e314534bb1f079a4bc4616b40a8fd62ee`	payload	2026-09-21	100%
sha256_hash	`5fabab3dc7f8b73ee1343b01ea9e3d7802a41d12e9a03b1c80f66b72b98fd3fa`	payload	2026-09-21	100%
sha256_hash	`dbedefe4ca5494b6188085e27b17f0f3133fe2ec7df04cfe69714f8047c994bf`	payload	2026-09-21	100%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["534b55b6772e5c2669f325bc877056c874a180650253e4bd5844ffaf69c384b6", "a2da9aba412172006b2ba30e2168ec030dabcdf8c46e6895ffba1c26834251a6", "382a3e22d91b93c67de463fde451870620e661b8e96f40a4ece80a2d3543a03f", "c254bf1cd9ab1496ad01785ed181bd6e314534bb1f079a4bc4616b40a8fd62ee", "5fabab3dc7f8b73ee1343b01ea9e3d7802a41d12e9a03b1c80f66b72b98fd3fa", "dbedefe4ca5494b6188085e27b17f0f3133fe2ec7df04cfe69714f8047c994bf"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — AMOS

False Positive Guidance

Legacy Application Maintenance: A specific line-of-business application (e.g., a custom Java-based inventory system) uses a shared library or configuration file that matches one of the AMOS hash IOCs due to a known, benign code reuse pattern. Filter: Exclude the specific executable path (e.g., C:\Apps\Inventory\bin\libcore.dll) or the specific user account (svc-inventory-app) from the IOC match if the file is signed by the vendor and resides in the application directory.
Third-Party Plugin/Extension: A widely used browser extension or IDE plugin (e.g., a specific version of a VS Code extension or Chrome extension) contains a background script or helper binary that matches an AMOS IOCs. Filter: Exclude processes spawned by known plugin hosts (e.g., code.exe, chrome.exe) where the matching file is located in the user’s AppData plugin directory (e.g., %APPDATA%\Code\User\globalStorage\...).
Scheduled Backup/Archive Job: A scheduled task (e.g., DailyDBBackup) creates temporary archive files or intermediate logs that transiently match an AMOS IOCs during the compression or hashing phase. Filter: Exclude events where the parent process is a known backup utility (e.g., vssadmin.exe, wbadmin.exe, or robocopy.exe) and the file path contains Temp or Backup directories, provided the file is deleted within 15 minutes.
Development Environment Artifacts: Developers working on a specific microservice project have a local build artifact or test fixture that matches an AMOS IOCs. Filter: Exclude matches occurring under user-specific development directories (e.g., C:\Users\<dev-user>\Projects\<project-name>\build\) or when the parent process is a development tool (e.g., msbuild.exe, `gradle.exe