ThreatFox: Formbook IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying Formbook malware to exfiltrate credentials and cryptocurrency wallet data through phishing vectors that compromise endpoint security. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly identify and contain data theft incidents before sensitive information reaches command-and-control servers.

IOC Summary

Malware Family: Formbook Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`74eb42416b47c082fc867764b577ceac6f1bd68e192695d79a9e48a7bd3fdd69`	payload	2026-07-31	95%
sha1_hash	`aa68f095eebfae5a1122dd82c9c4e9373af1b0ec`	payload	2026-07-31	95%
md5_hash	`2d5137f186bd8f99e610367e7bab3631`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["74eb42416b47c082fc867764b577ceac6f1bd68e192695d79a9e48a7bd3fdd69", "aa68f095eebfae5a1122dd82c9c4e9373af1b0ec", "2d5137f186bd8f99e610367e7bab3631"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

False Positive Scenarios for “ThreatFox: Formbook IOCs” Detection Rule

Scenario 1: Automated Browser Data Backup via Enterprise Tools
- Context: In environments using enterprise browser management solutions like Microsoft Intune or VMware Workspace ONE, scheduled tasks often trigger automated backups of user profiles, including cached credentials and browsing history. These tools may initiate outbound connections to cloud storage endpoints (e.g., Azure Blob Storage or AWS S3) that share IP ranges or domain patterns similar to Formbook’s C2 infrastructure.
- Suggested Filter/Exclusion: Create an exclusion rule for traffic originating from specific service accounts (e.g., svc-intune-backup) and destined for known enterprise storage domains (e.g., *.azureedge.net, s3.amazonaws.com). Additionally, filter out connections where the user agent string explicitly contains “Microsoft.Intune” or “WorkspaceOne”.
Scenario 2: Legitimate Phishing Simulation Campaigns
- Context: Security teams frequently conduct internal phishing simulations using platforms like KnowBe4, Proofpoint, or Coveware. These campaigns often distribute emails with attachments (PDFs, ZIPs) that mimic real-world threats. When users interact with these simulated malicious payloads, the endpoints may generate network traffic to the simulation platform’s C2 servers, which could be misidentified as Formbook activity due to similar payload structures and exfiltration patterns.
- Suggested Filter/Exclusion: Exclude traffic generated by known internal phishing simulation domains (e.g., *.knowbe4.com, *.proofpoint.com) during specific campaign windows. Implement a filter that suppresses alerts if the source email is tagged with an internal “Simulation” header or originates from a dedicated security distribution list.
Scenario 3: Scheduled Cryptocurrency Wallet Syncing for Corporate Treasury *