ThreatFox: Formbook IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Formbook malware to stealthily exfiltrate critical assets such as credentials and browser data through covert network channels. Proactively hunting for these indicators in Azure Sentinel is essential to detect early-stage data theft operations before they compromise sensitive organizational information.

IOC Summary

Malware Family: Formbook Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`5326cd216b594557d92a20e67d1074e532c4817ebc078ca41e9d92d315c160e3`	payload	2026-07-27	95%
sha1_hash	`b36cdaa68a18962e07f3d9c862b4f0bf17c16345`	payload	2026-07-27	95%
md5_hash	`a0995e073911c897ff2b5652a8bad3a8`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["5326cd216b594557d92a20e67d1074e532c4817ebc078ca41e9d92d315c160e3", "b36cdaa68a18962e07f3d9c862b4f0bf17c16345", "a0995e073911c897ff2b5652a8bad3a8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Formbook IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Browser Data Backup via Enterprise Management Tools
- Context: Admins often configure tools like Microsoft Endpoint Configuration Manager (MECM) or Jamf Pro to perform nightly scheduled jobs that back up browser profiles (Chrome/Edge) and credential stores. These processes initiate outbound connections to cloud storage endpoints (e.g., Azure Blob Storage, AWS S3) which may match the Formbook exfiltration logic due to similar payload sizes and destination IPs.
- Suggested Filter: Create an exclusion based on the Process Image Path for known management agents (e.g., C:\Program Files\Microsoft Configuration Manager\ccmexec.exe or /usr/bin/jamf) AND restrict the alert if the destination IP belongs to the organization’s verified cloud storage CIDR blocks.
Scenario: Legitimate Cloud Sync Operations by Productivity Suites
- Context: Applications like OneDrive for Business, Google Workspace Drive, and Dropbox Business frequently exfiltrate user data (including cached credentials and browser history) to their respective cloud endpoints. If the Formbook rule flags specific IOCs related to “browser data exfiltration,” these high-volume sync events can trigger false positives, especially when users have large profile folders syncing during peak hours.
- Suggested Filter: Exclude traffic where the Destination Domain matches known enterprise SaaS providers (e.g., *.office365.com, *.googleapis.com, *.dropbox.com) and the User Agent String contains signatures of these specific sync clients rather than generic browser agents.
Scenario: Scheduled Credential Harvesting by Third-Party Security Scanners *