ThreatFox: AMOS IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the AMOS threat actor by monitoring three specific indicators of compromise within Azure Sentinel logs. Proactively hunting for these signals is critical because early identification of AMOS-related IOCs enables the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before broader impact occurs.

IOC Summary

Malware Family: AMOS Total IOCs: 3 IOC Types: domain, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
domain	`fabric16.com`	payload_delivery	2026-07-22	100%
domain	`kainashirt.com`	payload_delivery	2026-07-22	100%
sha256_hash	`fc2009166867bee88885f2f889a608260cb971c1e946bbb79ea7d75ae0d429f6`	payload	2026-07-22	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AMOS
let malicious_domains = dynamic(["fabric16.com", "kainashirt.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["fc2009166867bee88885f2f889a608260cb971c1e946bbb79ea7d75ae0d429f6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — AMOS

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AMOS IOCs detection rule, tailored for a legitimate enterprise environment:

Scenario: Endpoint Protection Scheduled Scans
- Context: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon perform daily scheduled scans. The scanning engine frequently queries threat intelligence feeds (including AMOS) to update local definitions and check against known IOCs, generating network traffic that matches the rule’s signature.
- Suggested Filter/Exclusion: Exclude processes where ProcessName is MsMpEng.exe, C-Store.exe, or csfalcon.exe AND the source IP belongs to the internal management subnet (e.g., 10.x.x.x).
Scenario: SIEM Threat Intelligence Ingestion Jobs
- Context: The organization’s central Security Information and Event Management (SIEM) system, such as Splunk Enterprise Security or IBM QRadar, runs a nightly scheduled job to pull threat feeds from the AMOS portal via API. This ingestion process generates HTTP/HTTPS requests containing AMOS-specific IOCs that trigger the hunt package.
- Suggested Filter/Exclusion: Create an exclusion rule for traffic originating from the SIEM server’s hostname (e.g., siem-prod-01) where the destination port is 443 and the user agent string contains “Splunk” or “QRadar”.
Scenario: Admin Manual IOC Verification
- Context: A Security Operations Center (SOC) analyst manually validates a new threat intelligence feed using PowerShell scripts or Python automation tools. During this verification, they query the AMOS API to test connectivity and retrieve sample IOCs, which mimics the behavior of an active threat detection event.
- **Suggested Filter