ThreatFox: AMOS IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the AMOS threat actor, which is frequently linked to advanced persistent threats and ransomware operations. Proactively searching for these IOCs in Azure Sentinel allows the SOC to identify potential footholds or lateral movement activities before they escalate into a full-blown breach or data exfiltration event.

IOC Summary

Malware Family: AMOS Total IOCs: 3 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`5b7487d9528a49f6b83d41c772529b4d02d08a363c4501a60a3c8f9a3eeb53fa`	payload	2026-09-24	100%
sha256_hash	`8a4ef80cf6dbce39425c82d90953189e14ff8fc4c69627a6f06d24565c3421ec`	payload	2026-09-24	100%
sha256_hash	`5d73b00bd37e96853bcb1f2cba845ce806b3c0dd8b83be3aaa58d0f42a235152`	payload	2026-09-24	100%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["5b7487d9528a49f6b83d41c772529b4d02d08a363c4501a60a3c8f9a3eeb53fa", "8a4ef80cf6dbce39425c82d90953189e14ff8fc4c69627a6f06d24565c3421ec", "5d73b00bd37e96853bcb1f2cba845ce806b3c0dd8b83be3aaa58d0f42a235152"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — AMOS

False Positive Guidance

Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice that includes a build artifact or dependency package with a SHA256 hash matching one of the AMOS IOCs.
- Filter/Exclusion: Exclude alerts where the parent process is a known CI/CD agent (e.g., jenkins.exe, docker.exe, kubectl.exe) or where the file path resides within standard build directories (e.g., C:\Jenkins\workspace\, /var/lib/jenkins/).
Scenario: An IT administrator manually downloads a specific version of a third-party utility or SDK from a vendor’s website for testing purposes, and the file’s hash coincidentally matches an IOC due to a shared library component or a generic build artifact.
- Filter/Exclusion: Exclude alerts if the file is located in a user’s Downloads folder or a designated Temp directory and the parent process is a web browser (e.g., chrome.exe, msedge.exe) or a file explorer (explorer.exe), provided the file has not been executed or moved to a system directory.
Scenario: A security testing team performs a controlled penetration test or red team exercise, intentionally deploying a benign script or binary that uses a hash signature similar to the AMOS IOCs to validate detection coverage.
- Filter/Exclusion: Exclude alerts during defined maintenance windows or if the source IP address belongs to the internal Red Team/Blue Team subnet range (e.g., 10.20.0.0/24) and the user account is tagged with a redteam or pentest AD group.
Scenario: A legacy application or internal tool is updated via a scheduled task (e.g., Task Scheduler or cron) that replaces