ThreatFox: Grandoreiro IOCs

Hunt Hypothesis

This hunt identifies potential Grandoreiro ransomware activity by correlating known indicators of compromise with asset telemetry, targeting the initial access or lateral movement phases of the attack chain. Proactively hunting for these IOCs in Azure Sentinel is critical to detect and isolate compromised endpoints before the adversary deploys the ransomware payload and encrypts critical business data.

IOC Summary

Malware Family: Grandoreiro Total IOCs: 2 IOC Types: sha256_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Grandoreiro
let malicious_ips = dynamic(["174.129.92.184"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["174.129.92.184"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Grandoreiro
let malicious_hashes = dynamic(["f47ed4ce3fb2d369dc31737419e1546abb3be79052b910e52347c05500d908ab"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Grandoreiro

False Positive Guidance

• Scenario: A DevOps team deploys a new internal container image or binary that shares a specific SHA-256 hash or file size with a known Grandoreiro component due to a shared dependency library (e.g., a common Python package or Go binary).
  • Filter/Exclusion: Exclude alerts where the source path resides in standard development directories (e.g., C:\dev\, /opt/builds/) or where the parent process is a known build tool (e.g., docker.exe, make.exe, msbuild.exe).
• Scenario: An IT administrator manually downloads a specific version of a third-party utility (e.g., a legacy PDF converter or network diagnostic tool) that matches one of the IOCs (such as a specific file size or hash) because the vendor has not updated the binary since the Grandoreiro campaign was identified.
  • Filter/Exclusion: Create a whitelist for specific file paths in administrative download folders (e.g., C:\Users\Admin\Downloads\) and verify the digital signature of the file before alerting; exclude if the file is signed by a trusted vendor certificate.
• Scenario: A scheduled maintenance job runs a script that generates a temporary log file or cache file with a name or size matching an IOC (e.g., a 1.2MB log file named temp.dat), which is then cleaned up by the same script within seconds.
  • Filter/Exclusion: Exclude alerts for files located in temporary directories (%TEMP%, /tmp/) that are created and deleted within a short time window (e.g., < 30 seconds) and are child processes of known scheduled task executables (e.g., schtasks.exe, cron).
• Scenario: A security team performs a red team exercise or threat hunt using a sample file that intentionally matches Grandoreiro