ThreatFox: NetWorm IOCs

Hunt Hypothesis

This detection rule identifies the establishment of covert communication channels by the NetWorm malware family, which are specifically designed to facilitate the stealthy exfiltration of sensitive data. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly detect and contain active data theft attempts before adversaries can compromise large volumes of confidential information.

IOC Summary

Malware Family: NetWorm Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWorm
let malicious_hashes = dynamic(["b2daee69272ac088ba3af90e630a7b73", "a1b471e7cb4cabe80828dfb0b96cc6f5f87bf867969c66bc8511715ecd70459e", "6682841224071055bf109254dfc7a65d46ffbb9e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NetWorm

False Positive Guidance

• Scenario: Enterprise backup agents (e.g., Veeam, Commvault, or Rubrik) initiating outbound connections to cloud storage endpoints or management consoles that match NetWorm’s known IOCs. These agents frequently establish persistent, high-volume data transfer sessions for scheduled backups which can mimic the exfiltration behavior of the malware.

  • Filter/Exclusion: Create an allow-list rule excluding traffic originating from specific backup service accounts (e.g., vsm_service, commvault_agent) and restricting the exclusion to known backup destination IP ranges or FQDNs (e.g., *.veeam.com, *.rubrik.com).

• Scenario: Scheduled administrative scripts utilizing PowerShell or Python to perform automated data synchronization with external SaaS platforms (such as OneDrive for Business, SharePoint Online, or Salesforce). These scripts often use standard HTTP/HTTPS ports and may utilize user-agent strings or connection patterns that overlap with NetWorm’s covert channel signatures.

  • Filter/Exclusion: Implement a filter based on the specific process path of the automation script (e.g., C:\Scripts\DailySync.ps1) and exclude traffic where the destination domain matches the known SaaS provider domains, ensuring the exclusion applies only during defined maintenance windows or via specific scheduled task IDs.

• Scenario: DevOps pipelines executing CI/CD workflows using tools like Jenkins, GitLab Runner, or Azure DevOps Agents that pull artifacts from external registries (e.g., Docker Hub, GitHub Packages) and push build logs to monitoring systems. These agents frequently open outbound connections for artifact retrieval and telemetry reporting, which can be flagged as suspicious exfiltration attempts.

  • Filter/Exclusion: Exclude traffic generated by the CI/CD service accounts (e.g., jenkins-agent, gitlab-runner) running on designated build servers, specifically filtering out connections to known registry IPs and monitoring endpoints (