ThreatFox: DarkTortilla IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the DarkTortilla campaign by monitoring specific indicators of compromise that signal potential reconnaissance or initial access attempts within the Azure Sentinel environment. Proactive hunting for these IOCs is critical because DarkTortilla targets high-value sectors with sophisticated tradecraft, and early identification allows the SOC team to rapidly isolate affected assets before lateral movement occurs.

IOC Summary

Malware Family: DarkTortilla Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`198906594ae1cb1951d6e75e1921a7dd1188c8356371b847556ff15226dc5e83`	payload	2026-07-24	95%
sha1_hash	`21e5f10d7fef1dea915d7a39ce867b2948eee944`	payload	2026-07-24	95%
md5_hash	`24711f1cd12f005cdf6353c261f8eaf4`	payload	2026-07-24	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkTortilla
let malicious_hashes = dynamic(["198906594ae1cb1951d6e75e1921a7dd1188c8356371b847556ff15226dc5e83", "21e5f10d7fef1dea915d7a39ce867b2948eee944", "24711f1cd12f005cdf6353c261f8eaf4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkTortilla

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DarkTortilla IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario: Automated Threat Intelligence Feed Ingestion
- Context: The Security Operations Center (SOC) utilizes a dedicated threat intelligence platform (e.g., Tenable.io, Recorded Future, or MISP) that automatically ingests and distributes IOCs from external feeds. When the DarkTortilla feed is updated, the ingestion engine may trigger network traffic or file hash matches against the rule’s specific IOCs as part of its normal synchronization process.
- Filter/Exclusion: Exclude alerts where the source host is a known threat intelligence server (e.g., Host_Name contains “Tenable-Feed” or IP range 10.20.50.x) and the process name matches the ingestion service (e.g., feed_sync_service.exe).
Scenario: Scheduled Endpoint Security Policy Updates
- Context: Enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform scheduled definition updates. These agents often download signature packs containing known malicious hashes (including DarkTortilla IOCs) to update their local databases, which can trigger file creation or network connection events matching the detection logic.
- Filter/Exclusion: Create a filter excluding alerts where the parent process is the endpoint agent service (e.g., FalconSensor.exe, S1Agent.exe, or MsMpEng.exe) and the event timestamp aligns with the scheduled update window (e.g., between 02:00–04:00 local time).
Scenario: Admin-Driven Forensic Analysis and Hunting
- Context: During routine threat hunting exercises or incident response