ThreatFox: Gentlemen IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Gentlemen threat actor by monitoring specific Indicators of Compromise (IOCs) known to be utilized in their campaigns. SOC teams should proactively hunt for these signals within Azure Sentinel to enable early discovery and rapid containment of potential intrusions before they escalate into broader compromises.

IOC Summary

Malware Family: Gentlemen Total IOCs: 2 IOC Types: md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Gentlemen
let malicious_hashes = dynamic(["ff709591615a26f037a465ce97cc59d6", "1ecaf7098bedaa4ffae0fff3e077f937"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Gentlemen

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Gentlemen IOCs rule:

• Scenario 1: Scheduled Endpoint Security Updates

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. A nightly scheduled job (e.g., Task Scheduler task named “Update_Threat_Intel”) automatically pulls the latest IOCs from an internal Threat Intelligence feed. If the “Gentlemen” campaign indicators are part of this standard feed, the detection logic will trigger on every successful update run across all managed endpoints.
  • Suggested Filter/Exclusion: Create a rule exclusion based on the Process Name and Parent Process. Exclude events where ProcessName is falcon.sysmon.exe (CrowdStrike) or MsSenseService.exe (Defender) AND the CommandLine contains keywords like “update”, “sync”, or “pull”. Alternatively, exclude traffic originating from the specific IP address of the internal Threat Intelligence Server.

• Scenario 2: Admin-Led Vulnerability Scanning

  • Context: The IT Security team runs a weekly vulnerability assessment using Tenable Nessus or Qualys. During the scan, the scanner probes various network ports and injects specific test payloads that match the “Gentlemen” IOCs (e.g., specific User-Agent strings or HTTP headers used by the Gentlemen malware) to verify firewall rules. This results in high-volume alerts on the scanning server itself.
  • Suggested Filter/Exclusion: Implement a source-based exclusion for the Vulnerability Management Server IP. Additionally, add a logic filter where if SourcePort is within the range of known scanner ports (e.g., 1743-1745 for Tenable) and the destination is not a critical asset group