ThreatFox: Amadey IOCs

Hunt Hypothesis

This detection rule identifies the initial infection phase of the Amadey ransomware family by monitoring for phishing-delivered malicious attachments or links that trigger exploit kits and compromised credential usage. SOC teams should proactively hunt for this threat in Azure Sentinel to detect early-stage lateral movement, anomalous file encryption patterns, and command-and-control communications beyond known domains before widespread data exfiltration occurs.

IOC Summary

Malware Family: Amadey Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Amadey
let malicious_domains = dynamic(["uybwveyvyt62rc.site", "zsv2c62243.space"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Amadey

False Positive Guidance

False Positive Scenarios: ThreatFox: Amadey IOCs Detection Rule

• Scenario 1: Legitimate Enterprise Backup Encryption Jobs

  • Context: Scheduled backup agents (e.g., Veeam, Commvault, or Rubrik) often encrypt large volumes of critical data nightly. The detection logic may misinterpret the rapid file modification and encryption patterns as Amadey ransomware activity, especially if the backup service communicates with external cloud storage domains not yet whitelisted in the rule’s C2 list.
  • Suggested Filter/Exclusion: Create an exclusion based on the specific Service Account identity (e.g., DOMAIN\svc_backup_agent) and the process name (vbr.exe or commvault-agent). Additionally, filter out network traffic where the destination port is 443 and the source process matches known backup binaries during defined maintenance windows (e.g., 02:00–06:00 UTC).

• Scenario 2: Phishing Simulation Campaigns with Malicious Attachments

  • Context: Security teams frequently run internal phishing simulations using tools like KnowBe4 or Proofpoint, which distribute emails containing mock “malicious” attachments (e.g., .docx files with macros) to test user behavior. If the simulation platform’s delivery infrastructure uses domains similar to Amadey’s known IOCs, or if users open these attachments triggering macro execution that mimics exploit kit deployment, it can trigger a false positive.
  • Suggested Filter/Exclusion: Exclude traffic originating from the internal Phishing Simulation Gateway IP range (e.g., 10.x.x.x subnet) and filter out events where the email subject line contains specific simulation keywords like “[SIMULATION]” or “Test Campaign.” Furthermore, whitelist the specific hash values of the simulated attachment files used in the current quarter.

• **Scenario 3: