ThreatFox: Formbook IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Formbook malware to exfiltrate sensitive credentials and cryptocurrency data through phishing vectors or compromised web resources. Proactive hunting in Azure Sentinel is critical to identify anomalous outbound network traffic and unexpected process executions that may indicate early-stage data theft before significant asset loss occurs.

IOC Summary

Malware Family: Formbook Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`19a808fc17642b6f12340e5fbac9520a3c2b2f03`	payload	2026-07-24	95%
md5_hash	`fcac06aded114ab89c60bce606c5c217`	payload	2026-07-24	95%
sha256_hash	`1f30a807c047970be0b5cfcb0c2a7bc1958d7474ea4920ade5980b5942d3ddbb`	payload	2026-07-24	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["19a808fc17642b6f12340e5fbac9520a3c2b2f03", "fcac06aded114ab89c60bce606c5c217", "1f30a807c047970be0b5cfcb0c2a7bc1958d7474ea4920ade5980b5942d3ddbb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

False Positive Scenarios: ThreatFox: Formbook IOCs

Legitimate Browser Auto-Update Traffic
- Scenario: Major browsers like Microsoft Edge or Google Chrome frequently initiate outbound connections to their respective update servers (e.g., go.microsoft.com, clients.google.com) to download patches and telemetry data. Since Formbook targets browser data, the detection logic may flag these high-volume, predictable HTTPS connections as suspicious exfiltration attempts.
- Filter/Exclusion: Create a whitelist rule excluding outbound traffic from known browser executables (msedge.exe, chrome.exe) connecting to verified update domains and IP ranges defined in the enterprise’s allow-list.
Scheduled Credential Backup Jobs
- Scenario: Enterprise Identity Management tools, such as Microsoft Active Directory Federation Services (ADFS) or third-party solutions like CyberArk, often run scheduled PowerShell scripts (Backup-Credential.ps1) during off-hours to archive user credentials and session tokens to internal storage. These jobs generate significant outbound traffic that mimics the data exfiltration behavior of Formbook.
- Filter/Exclusion: Exclude alerts triggered by specific service accounts (e.g., svc-backup-job) running scheduled tasks between 02:00 and 04:00 UTC, provided the destination IP belongs to the internal backup subnet rather than external C2 servers.
DevOps CI/CD Pipeline Artifacts
- Scenario: Development teams utilize tools like Jenkins or GitHub Actions to push build artifacts, logs, and container images to cloud repositories (e.g., AWS S3, Azure Blob Storage). These pipelines execute complex process chains that upload large datasets, which can be misidentified as Formbook’s data-stealing mechanism targeting cryptocurrency wallets or browser caches.
- Filter/Exclusion: Implement a filter for process executions originating from the jenkins-agent