This hunt targets the presence of known Formbook indicators of compromise, which are frequently used by threat actors to establish persistence and execute malicious payloads on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the malware can propagate laterally or exfiltrate sensitive data.
Malware Family: Formbook Total IOCs: 9 IOC Types: sha1_hash, md5_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 9572479ba34ee697424f84bcf7ea4c5079750acc72a0ae53a6550eb73e386a1f | payload | 2026-09-21 | 95% |
| sha1_hash | fbef5c9a52ca4e76406078db75247d1f62a6f54b | payload | 2026-09-21 | 95% |
| md5_hash | 52924fe766055fbb3b58e1978076e2e6 | payload | 2026-09-21 | 95% |
| md5_hash | 8b412017ea27ddf94c4bd31b70588969 | payload | 2026-09-21 | 95% |
| sha256_hash | acbee935f62700c1a758a166789368933edfd54b7e6a93a022143b59eb6ecf70 | payload | 2026-09-21 | 95% |
| sha1_hash | 215f866e5091b11c4ca89c7180e70e60988e4897 | payload | 2026-09-21 | 95% |
| sha1_hash | d318afaddcb5e67bf0f8cef83420f0d1ea690edc | payload | 2026-09-21 | 95% |
| md5_hash | 204d2a41920c68f78e996daaf069c722 | payload | 2026-09-21 | 95% |
| sha256_hash | b26c37434671d62ad1e1396db886d0419bf778d4ca5b3b54cf46319c40c277e0 | payload | 2026-09-21 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["9572479ba34ee697424f84bcf7ea4c5079750acc72a0ae53a6550eb73e386a1f", "fbef5c9a52ca4e76406078db75247d1f62a6f54b", "52924fe766055fbb3b58e1978076e2e6", "8b412017ea27ddf94c4bd31b70588969", "acbee935f62700c1a758a166789368933edfd54b7e6a93a022143b59eb6ecf70", "215f866e5091b11c4ca89c7180e70e60988e4897", "d318afaddcb5e67bf0f8cef83420f0d1ea690edc", "204d2a41920c68f78e996daaf069c722", "b26c37434671d62ad1e1396db886d0419bf778d4ca5b3b54cf46319c40c277e0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: The Formbook IOCs often include specific file hashes or paths associated with older, unpatched versions of common enterprise software (e.g., specific builds of Adobe Reader or Java). When IT operations push updates to legacy applications across the domain via Group Policy Objects (GPO), these files are written to the C:\Program Files or C:\Windows directories on hundreds of endpoints simultaneously.
gpupdate.exe or svchost.exe (specifically the gpupdate service) and the file path resides within standard application directories like C:\Program Files\ or C:\Program Files (x86)\.Scheduled Maintenance Scripts in Temp Directories: Many enterprise applications (such as SAP, Oracle, or custom internal tools) use scheduled tasks to dump temporary configuration files, logs, or cache data into the user’s %TEMP% or %LOCALAPPDATA% directories. If the IOC list includes generic filenames or hashes that match these temporary artifacts, the detection will trigger during routine daily maintenance windows.
\Temp\ or \Local\Temp\ and the parent process is a known application executable (e.g., java.exe, sapgui.exe, or python.exe) rather than a shell or unknown binary.Developer Build Artifacts in CI/CD Agents: In development environments, Continuous Integration/Continuous Deployment (CI/CD) agents (like Jenkins, Azure DevOps, or GitLab runners) frequently compile code and generate binary artifacts in workspace directories. If the IOC list includes hashes for common build tools or intermediate object files, these will be generated repeatedly during build pipelines, triggering false positives on build servers or developer workstations.