ThreatFox: PhonyC2 IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known PhonyC2 command-and-control infrastructure to identify compromised assets communicating with malicious endpoints. Proactively hunting these IOCs in Azure Sentinel allows the SOC to detect active PhonyC2 infections early, preventing lateral movement and data exfiltration before they escalate.

IOC Summary

Malware Family: PhonyC2 Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`cfa1c609d1596ca066c6c6e9fce1ad44`	payload	2026-09-21	95%
sha256_hash	`27831a5b95bbc1fab82732019109d94feefcb31fa4c4815eeb7500ba702c174d`	payload	2026-09-21	95%
sha1_hash	`9bbc180af0625e0483058b2daa77b8318a1573bd`	payload	2026-09-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - PhonyC2
let malicious_hashes = dynamic(["cfa1c609d1596ca066c6c6e9fce1ad44", "27831a5b95bbc1fab82732019109d94feefcb31fa4c4815eeb7500ba702c174d", "9bbc180af0625e0483058b2daa77b8318a1573bd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — PhonyC2

False Positive Guidance

Automated Vulnerability Scanning and Penetration Testing
- Scenario: Security teams using tools like Nessus, Qualys, or Metasploit to perform routine vulnerability assessments or red team exercises may intentionally connect to known PhonyC2 IOCs (IPs/URLs) to verify detection coverage or test network egress policies.
- Filter/Exclusion: Exclude source IPs belonging to the designated Security Operations (SOC) or Red Team subnet (e.g., 10.20.0.0/24) or exclude processes named nessus.exe, msfconsole.exe, or qualys_agent.exe when the destination matches the IOC list.
Legacy Application Update Checkers
- Scenario: Older enterprise applications (e.g., Adobe Flash Player legacy installs, Java JRE update checkers, or specific SAP modules) may still be configured to poll outdated or hardcoded update endpoints that coincide with PhonyC2 IOCs due to shared infrastructure or historical DNS records.
- Filter/Exclusion: Exclude processes known to be legacy update agents (e.g., javaw.exe, acrobat.exe, sapgui.exe) if the connection occurs during a scheduled maintenance window (e.g., Sundays 02:00–04:00 UTC) and the source user is a service account (e.g., svc_app_update).
DNS Caching and Resolver Behavior
- Scenario: Internal DNS servers (e.g., Windows DNS Server or BIND) may resolve or cache queries for PhonyC2 IOCs due to stale cache entries, internal testing zones, or recursive resolution requests from client machines that are not directly connecting but are querying the resolver.
- **Filter/Ex