ThreatFox: Formbook IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by matching network and endpoint telemetry against nine specific Indicators of Compromise (IOCs) linked to the Formbook threat intelligence feed. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly uncover early-stage compromises or lateral movement attempts that may not yet trigger standard alerting thresholds, ensuring timely containment of potential threats.

IOC Summary

Malware Family: Formbook Total IOCs: 9 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`4b2911bf6128350411e6dd6b676a1148`	payload	2026-07-25	95%
sha256_hash	`8c2ca1c6a2ecf606ceb778ecc9928508727dc36598426e958da23b72cb6368e0`	payload	2026-07-25	95%
sha1_hash	`6560d48b4bc94813b44a42865d30b44689a0f7e2`	payload	2026-07-25	95%
md5_hash	`4128b578cfee06b281d580844fd5872f`	payload	2026-07-25	95%
md5_hash	`0526be67da8581b2acf18d065db0f899`	payload	2026-07-25	95%
sha256_hash	`7a39334c50e0ccb49d2ea85d615e2eef259a7232f36c4803c2d853b64639b6fa`	payload	2026-07-25	95%
sha1_hash	`e3b93e6c2a7964ab53cdb514f19a9489dc4383b2`	payload	2026-07-25	95%
sha256_hash	`537b51a091c4176254ab69a08eec14183d44c868cf9c43666caddcaf2843d24f`	payload	2026-07-25	95%
sha1_hash	`be94e61c386578d4f3aeab05b1ead296be0497a7`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["4b2911bf6128350411e6dd6b676a1148", "8c2ca1c6a2ecf606ceb778ecc9928508727dc36598426e958da23b72cb6368e0", "6560d48b4bc94813b44a42865d30b44689a0f7e2", "4128b578cfee06b281d580844fd5872f", "0526be67da8581b2acf18d065db0f899", "7a39334c50e0ccb49d2ea85d615e2eef259a7232f36c4803c2d853b64639b6fa", "e3b93e6c2a7964ab53cdb514f19a9489dc4383b2", "537b51a091c4176254ab69a08eec14183d44c868cf9c43666caddcaf2843d24f", "be94e61c386578d4f3aeab05b1ead296be0497a7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Formbook IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Compliance Reporting via PowerShell
- Context: The internal GRC (Governance, Risk, and Compliance) team runs a nightly scheduled task using PowerShell.exe to query the Formbook API for audit logs. This script executes against specific Formbook IOCs (e.g., known API endpoints or hash signatures) which triggers the detection rule as a potential external threat interaction.
- Filter/Exclusion: Create an exclusion rule in your SIEM/SOAR platform that suppresses alerts where the Process Name is powershell.exe, the Parent Process Name is TaskScheduler.exe (or svchost.exe if running as a service), and the Destination IP matches the internal Formbook API gateway CIDR block.
Scenario: Endpoint Protection Policy Updates
- Context: The enterprise-wide endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads threat intelligence feeds from Formbook to update local detection signatures. This download process generates network traffic and file hash events that match the 9 IOCs defined in the hunt package, causing a false positive on the EDR agents themselves.
- Filter/Exclusion: Apply a filter to exclude alerts where the Source Host is identified as an “Endpoint Management Server” or “Update Distribution Point,” and the Process Command Line contains keywords like --update-feed, --sync-signatures, or specific Formbook API tokens used by the EDR vendor.
Scenario: DevOps Pipeline Artifact Verification
- Context: During CI/CD deployments, the Jenkins or Azure DevOps build agents validate container images and configuration manifests against Form