ThreatFox: AMOS IOCs

Hunt Hypothesis

This hypothesis targets the presence of known AMOS malware indicators, which are frequently used for initial access and lateral movement within enterprise networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of persistent backdoors and data exfiltration associated with this high-severity threat.

IOC Summary

Malware Family: AMOS Total IOCs: 12 IOC Types: domain, sha256_hash, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AMOS
let malicious_domains = dynamic(["basequill9.com", "questlyric8.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["https://basequill9.com/curl/av6t87xg9gon/ahlg4goj9kfsh1itrutp47.dat", "https://basequill9.com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/hiddenfix/update", "https://questlyric8.com/api/metrics/run?event=pasted"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["d729286210cc1566ea7eef55258bc20fe94e418cb478ac5544feb288e2fb803c", "4701f196c74af42b5ced01592bf4a74d54437b1c63b8aabfe1f92e9beabec769", "bb2d62df63ff1726eec5e17cc9e30850c39d0a15353aa267a916bcdb75d709c6", "a39eb6928c17a779f4030bf6ac0eeec41f828a64140f2a06cb63b8658e589267", "6fa9d4e59f3555278ff55dd617356a51ecb43239abafa333c8fa82da2a1c7088", "5cc27b17795bd0cb766249d43e4082c5b900ef9d1184877cfa9c048533c945e0", "a07994990f1976669d69febbe9603be9e10132fe9f6d6e8e4184fa91462cba72"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

• Scenario: A DevOps engineer uses mosh (Mobile Shell) to maintain a persistent SSH session over an unstable network connection. The tool may bind to a non-standard high port (e.g., 60000+) or exhibit connection patterns that match the AMOS IOCs if the rule inspects for specific port ranges or connection durations.

  • Filter/Exclusion: Exclude processes named mosh or mosh-client where the parent process is an SSH client (ssh) or a terminal emulator (xterm, gnome-terminal, konsole). Additionally, exclude connections where the local port is within the standard mosh range (60000–61000).

• Scenario: A database administrator runs a scheduled mysqldump or pg_dump job that writes large temporary files to a shared network drive or local temp directory. If the AMOS IOCs include file size thresholds, specific hash values, or paths like /tmp/ or C:\Temp\, this legitimate backup activity could trigger the alert.

  • Filter/Exclusion: Exclude file creation events where the parent process is mysqldump, pg_dump, backup.sh, or rsync, and the destination path matches known backup directories (e.g., /var/backups/, C:\Backups\, or \\fileserver\backups\).

• Scenario: A security team deploys a custom Python-based scanning script using scapy or socket libraries to perform internal network discovery. If the AMOS IOCs include specific TCP/UDP packet signatures, source/destination IP pairs, or process names like python or python3 executing from a non-standard path (e.g., /opt/tools/scan/), this could be flagged.

  • **Filter