ThreatFox: Formbook IOCs

Hunt Hypothesis

This detection identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Formbook threat, signaling potential reconnaissance or initial access attempts within the environment. Proactive hunting for these IOCs in Azure Sentinel is critical to rapidly isolate compromised assets and mitigate high-severity threats before they escalate into broader lateral movement or data exfiltration campaigns.

IOC Summary

Malware Family: Formbook Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`e0bf699a9016ef9a7740953c6ec4feb0`	payload	2026-08-04	95%
sha256_hash	`438a199c60026b897fdda4da23d69e103cad34864a070d1b7659cf462628505f`	payload	2026-08-04	95%
sha1_hash	`bf119129aa816d95af82b5ed9194aaba52b0d90f`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["e0bf699a9016ef9a7740953c6ec4feb0", "438a199c60026b897fdda4da23d69e103cad34864a070d1b7659cf462628505f", "bf119129aa816d95af82b5ed9194aaba52b0d90f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: Formbook IOCs detection rule:

Scenario 1: Scheduled Endpoint Protection Scans
- Context: The enterprise utilizes Microsoft Defender for Endpoint (or CrowdStrike Falcon) which performs daily scheduled scans. During these scans, the EDR agent queries internal threat intelligence feeds or updates its local IOC database, triggering network connections to Formbook’s IOCs that mimic a live detection event rather than a malicious scan.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., MsMpEng.exe for Defender or csfalcon.exe) and restrict the trigger to occur only during non-business hours (02:00–04:00) if the scan is known to run then. Alternatively, exclude traffic where the Source User belongs to the “System” account or a dedicated service account like svc-antivirus.
Scenario 2: Admin-Led Threat Intelligence Feed Updates
- Context: Security Operations Center (SOC) analysts manually update threat intelligence feeds within their SIEM (e.g., Splunk or Microsoft Sentinel) by importing Formbook’s latest IOC list. This administrative action generates a burst of API calls and file downloads to the specific IOCs defined in the rule, which the detection logic interprets as an active threat discovery rather than a configuration task.
- Filter/Exclusion: Implement a filter that excludes events where the Source IP belongs to the SOC management subnet (e.g., 10.20.50.x) or where the Process Command Line contains keywords like “import,” “sync,” or “update_feed.” Additionally, whitelist specific admin accounts such as admin-soc or svc-threatintel.
**Scenario