ThreatFox: Grandoreiro IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Grandoreiro threat actor by monitoring specific indicators of compromise (IOCs) such as malicious IP addresses and file hashes within the network. A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage intrusions and mitigate potential data exfiltration or lateral movement before they escalate into a full-scale incident.

IOC Summary

Malware Family: Grandoreiro Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`54[.]91[.]129[.]132:5074`	botnet_cc	2026-08-11	75%
ip:port	`54[.]91[.]129[.]132:41694`	botnet_cc	2026-08-11	75%
ip:port	`54[.]91[.]223[.]28:1065`	botnet_cc	2026-08-11	75%
ip:port	`54[.]91[.]223[.]28:41667`	botnet_cc	2026-08-11	75%
ip:port	`54[.]80[.]154[.]193:6490`	botnet_cc	2026-08-11	75%
ip:port	`54[.]80[.]154[.]193:19941`	botnet_cc	2026-08-11	75%
ip:port	`54[.]91[.]129[.]132:4403`	botnet_cc	2026-08-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Grandoreiro
let malicious_ips = dynamic(["54.91.223.28", "54.80.154.193", "54.91.129.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["54.91.223.28", "54.80.154.193", "54.91.129.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Grandoreiro

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the ThreatFox: Grandoreiro IOCs detection rule:

Endpoint Protection Policy Deployment via Microsoft Intune
- Scenario: The IT security team pushes a new policy update to all workstations using Microsoft Intune, which includes a scheduled download of the latest threat intelligence feed. This process triggers network connections to the specific IP addresses and domains listed in the Grandoreiro IOC package as part of the standard update mechanism.
- Filter/Exclusion: Create an exclusion for traffic originating from the Microsoft Intune Management service account or specific device groups (e.g., “Corporate-Managed-Windows”) where the source process is IntuneManagementService.exe.
Automated Threat Intelligence Feed Ingestion by CrowdStrike Falcon
- Scenario: The enterprise’s endpoint detection and response (EDR) solution, CrowdStrike Falcon, runs a nightly scheduled job to ingest external threat intelligence feeds. This job establishes outbound connections to the Grandoreiro IOCs to validate signatures against the latest malware definitions, mimicking the behavior of the targeted threat.
- Filter/Exclusion: Exclude alerts where the source process is FalconSensor.exe (or CSFalconService) and the event type matches “Scheduled Task Execution” during maintenance windows (e.g., 02:00–04:00 UTC).
Cloud Backup Synchronization via Veeam Backup & Replication
- Scenario: The backup infrastructure utilizes a cloud repository hosted on an Azure tenant that shares the same network range or DNS resolution as one of the Grandoreiro IOCs. During peak backup windows, the VeeamBackupService initiates connections to these endpoints for metadata synchronization and log aggregation.
- Filter/Exclusion: Implement a whitelist rule for the specific IP